The Arcive of vBulletin Modifications Site.

pie · #1 05-16-2003, 10:32 PM

Most of us who know php know how to exploit the usertitle, well the code to allow html even if specified not to.

Im just wondering if theres ANYTHING i can do to stop it being exploited. I was talking over a mate how to do it and its got passed on :ermm: it wont get passed on anymore coz. i know he'll keep it to himself. Just what do i do if it does. LOL

filburt1 · #2 05-16-2003, 10:33 PM

Just don't allow anybody to use custom titles.

pie · #3 05-16-2003, 10:38 PM

fairy snuff. But for a few reasons on my boards i prefer them to. Anyway to stop it.

filburt1 · #4 05-16-2003, 10:40 PM

To my knowledge, stock vB doesn't allow it. Make sure you don't have any hacks that break user titles.

pie · #5 05-16-2003, 10:45 PM

stock vB?

filburt1 · #6 05-16-2003, 10:56 PM

Unhacked vB.

pie · #7 05-16-2003, 10:58 PM

is it ok to email u the code....? i mean as i dont want to release it.

Tigga · #8 05-17-2003, 01:20 PM

Wow... Never knew vBulletin had a small exploit there. Apparently it does work with a stock vBulletin as well. It wasn't hard to fix though. If you just look in your member.php file for addslashes($customtext) and replace that with addslashes(htmlspecialchars($customtext)) it should fix the problem.

filburt1 · #9 05-17-2003, 02:16 PM

On my board there was no problem and to my knowledge still isn't one. One member used a status of <?= mod ?> (or thereabouts) which would normally be parsed as HTML to most browsers (it would appear as nothing). However you saw the actual text instead.

Tigga · #10 05-17-2003, 07:07 PM

Yea, it doesn't seem to work for PHP code. It does for HTML though which could still be abused.