[Acers]

Originally Posted by Acers

here is a temporary fix, i have tested this locally only for the donate function and its working as far as this exploit goes, and since the same logic can be taken for other places where its used we can replace there

go to your vbplaza folder, find occurrences of the following:
includes/function_vbplaza.php
find around line 152(depending on the version you have)

PHP Code:

$message = strip_tags($message); 


make that

PHP Code:

$message = htmlspecialchars($message); 


go to
vbplaza/action.admindonate.php (line 133)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = htmlspecialchars($action['reason']); 


goto
vbplaza/action.changeotherusertitle.php (line 136)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = htmlspecialchars($newusertitle); 


goto
vbplaza/action.changeusertitle.php (line 87)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = htmlspecialchars($newusertitle); 


goto
vbplaza/action.donate.php (line 164)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = htmlspecialchars($action['reason']); 


goto
vbplaza/action.gift.php (line 209)

PHP Code:

$action['giftmessage'] = strip_tags($action['giftmessage']); 


make that

PHP Code:

$action['giftmessage'] = htmlspecialchars($action['giftmessage']); 


goto
vbplaza/action.ribbons.php (line 218)

PHP Code:

$action['ribbonmessage'] = strip_tags($action['ribbonmessage']); 


make that

PHP Code:

$action['ribbonmessage'] = htmlspecialchars($action['ribbonmessage']); 


Just changes the the php function with vb's own cleaning class.

includes/function_vbplaza.php(line 152)

PHP Code:

$message = strip_tags($message); 


make that

PHP Code:

$message = $vbulletin->input->clean($message, TYPE_NOHTML); 


go to
vbplaza/action.admindonate.php (line 133)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = $vbulletin->input->clean($action['reason'], TYPE_NOHTML); 


goto
vbplaza/action.changeotherusertitle.php (line 136)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = $vbulletin->input->clean($newusertitle, TYPE_NOHTML); 


goto
vbplaza/action.changeusertitle.php (line 87)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = $vbulletin->input->clean($newusertitle, TYPE_NOHTML); 


goto
vbplaza/action.donate.php (line 164)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = $vbulletin->input->clean($action['reason'], TYPE_NOHTML); 


goto
vbplaza/action.gift.php (line 209)

PHP Code:

$action['giftmessage'] = strip_tags($action['giftmessage']); 


make that

PHP Code:

$action['giftmessage'] = $vbulletin->input->clean($action['giftmessage'], TYPE_NOHTML); 


goto
vbplaza/action.ribbons.php (line 218)

PHP Code:

$action['ribbonmessage'] = strip_tags($action['ribbonmessage']); 


make that

PHP Code:

$action['ribbonmessage'] = $vbulletin->input->clean($action['ribbonmessage'], TYPE_NOHTML);