SRL Archive - SRL Archives

http://www.exploit-db.com/exploits/14833/

#  Patch :  #######################################################################
 
1 > Go to AdminCP
 
2 > Click on vBulletin Options and choose vBulletin Options
 
3 > Choose Censorship Options
 
4 > type &# in Censored Words section
 
5 > Then click on Save
 

Using ASCII codes you can make any name you like.
Included is how to fix it. :sasmokin:

I think someone should check this.

~onilika

O.o lolwut?

It's an old exploit but it works..

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.
vBulletin Skin developed by: vBStyles.com


It's the same Database I use when finding exploits for use with Metaspliot and Backtrack 5.. So.. this needs to get fixed..

From: ggzz
It's an old exploit but it works..

Nah I don't think it does.

From: ggzz
Ya think?

LOL!!!!!! LOLOL nice.. Hmm. and u can edit posts without it showing.. wow..

Breaking news: vBulletin is a piece of shit.

Thanks for the report though.

Its what happened to PatDuffy why he couldn't view his PMs and such. Its not really a dangerous exploit, but the version of vBul should probably be updated…

Vbul will always have exploits aslong a there are people who search for them :/ also atleas solution isn't extremely long and confusing :/

~Bro433

Conclusion of this thread: vBulletin sucks, and nielsie95 / Wizzup has some work to do.

Also; Change to phpBB

When I applied that fix, all the code blocks were broken.

Example of what I mean:

program new;


var
  R, G, B: Integer;
  _R, _G, _B: Integer;
  H, S, L: Extended;
  X, Y, Z: Extended;
  ll, A, bb: Extended;

begin
  ClearDebug;
  ColorToRGB(4091733, R, G, B);
  Writeln('(R, G, B) ' + IntToStr(R) + ', ' + IntToStr(G) + ', ' + IntToStr(B));

  RGBToHSL(R, G, B, H, S, L);
  Writeln('(H, S, L) ' + FloatToStr(H) + ', ' + FloatToStr(S) + ', ' + FloatToStr(L));

  HSLToRGB(H, S, L, _R, _G, _B);
  Writeln('(R, G, B) ' + IntToStr(_R) + ', ' + IntToStr(_G) + ', ' + IntToStr(_B));

  RGBToXYZ(R, G, B, X, Y, Z);
  Writeln('(X, Y, Z) ' + FloatToStr(X) + ', ' + FloatToStr(Y) + ', ' + FloatToStr(Z));

  XYZToRGB(X, Y, Z, _R, _G, _B);
  Writeln('(R, G, B) ' + IntToStr(_R) + ', ' + IntToStr(_G) + ', ' + IntToStr(_B));

  XYZToCIELab(X, Y, Z, bb, A, ll);
  Writeln('(L, A, B) ' + FloatToStr(L) + ', ' + FloatToStr(A) + ', ' + FloatToStr(ll));

  CIELabtoXYZ(bb, A, ll, X, Y, Z);
  Writeln('(X, Y, Z) ' + FloatToStr(X) + ', ' + FloatToStr(Y) + ', ' + FloatToStr(Z));

  setcolortolerancespeed(3);
  Writeln(SimilarColors(4091733, 255, 150));
end.

Someone try again, now?

From: Wizzup?
Someone try again, now?

stop tripple posting you noob

love you

From: Wizzup?
Someone try again, now?

Xploit fixed.. Dunno what that code above is though :S if that's for the simba tags, those were broken ages ago when editing them..

From: ggzz
Xploit fixed.. Dunno what that code above is though :S if that's for the simba tags, those were broken ages ago when editing them..

The filter also filters ( and ), that's why it doesn't work. I've used a different method, so it should work fine now.

Thanks for reminding, we had a lot of fun testing this exploit ~6 months ago.

From: Wizzup?
When I applied that fix, all the code blocks were broken.

[PHP]
.simba {
font-family: monospace;
}[/PHP]

or

[PHP]
<div class="simba" style="font-family: monospace;">
[/php]

Well what d'ya know? It works now!

Also, found your problem:
[php]
.alt2 {
…
font-family: tahoma,verdana,geneva,lucida,'lucida grande',arial,helvetica,sans-serif;
}[/php]

Create a new class, alt3, and give it the same properties, except change the font-family to monospace.