Powered by vBulletin® Version 4.2.0
vBulletin version 4.2.0 suffers from a persistent cross site scripting vulnerability in the calendar section
How to fix it?
Here we have vulnerable file named calendar.php in:
doc_root/vb/activitystream/view/perm/calendar/event.php
In line 74 to 77
public function fetchTemplate($templatename, $activity)
{
$eventinfo =& $this->content['event'][$activity['contentid']];
$calendarinfo =& $this->content['calendar'][$eventinfo['calendarid']];
Our title for events doesn't work. We need to filter it like this:
public function fetchTemplate($templatename, $activity)
{
$eventinfo =& $this->content['event'][$activity['contentid']];
$calendarinfo =& $this->content['calendar'][$eventinfo['calendarid']];
$eventinfo['title'] = htmlspecialchars_uni($eventinfo['title']);
I can't be bothered checking if you guys patched it, prolly did, but ey if not.