A cross-site scripting (XSS) vulnerability in the Admin.

[vbuser]

[URL redacted for security reasons]

A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.

I have a test version to test this, any pointers?

[glennrocksvb]

vbuser, thanks for posting this alleged vulnerability. I recommend reporting this to vBulletin.

But I noticed that the report was published in 2023. I'm not sure if this issue is still valid in vB 6.1.0 (the report said the issue affects 6.0.0). vBulletin should be informed (if not already) so they can officially confirm this alleged vulnerability.

[vbuser]

Yeah, I am aware of it. I am looking to pen test at my local host for learning, any pointers?

[glennrocksvb]

Sorry, due to the nature of your request, I must respectfully decline to provide specific guidance on how to test the reported vulnerability. I haven't looked into it myself but even if I did, I won't be able to help for ethical and legal reasons.

[vbuser]

No issues, I just wanna know how it works. Who runs vbulletin? when you have xenforo. nvm