Security Bulletin: vBShout Pro (vB3, vB4, vB5) / Advanced User Tagging Pro (vB3, vB4)

[Fillip H.]

Hey all,

We've recently been made aware of some local-only XSS exploits affecting the following products:

• vBShout Pro v6.2.0 & older for vB3 / vB4
• vBShout Pro v6.1.0a5 & older for vB5
• Advanced User Tagging Pro v3.0.6 & older for vB3 / vB4

The Lite versions of these products are not affected.
The vB5 version of Advanced User Tagging Pro is not affected.

While these exploits are very limited in the amount of damage they can do (other users are not affected, only the person attempting the exploit is affected), we've still made updated code available immediately.

For users who prefer to simply re-upload their mods, we've made "Patch Level 1" available for the affected modifications. If you do not have a current licence, you can perform the following file edits to secure your installations:

vBShout Pro v6.2.0 & older for vB3 / vB4

Open /dbtech/vbshout_pro/actions/profile.php and find:

		// Set checked
		$command['useinput'] = ($command['useinput'] ? ' checked="checked"' : '');

Add below:

		// Clean up these
		$command['command'] = htmlspecialchars_uni($command['command']);
		$command['output'] = htmlspecialchars_uni($command['output']);

vBShout Pro v6.1.0a5 & older for vB5

Open /core/packages/dbtechvbshout/api/vbshout/settings.php and find:

		return vB::getDbAssertor()->getRows('DBTechvBShout:dbtech_vbshout_command', array('userid' => vB::getUserContext()->fetchUserId()), array('command'), 'commandid');

Replace with:

		$commands = vB::getDbAssertor()->getRows('DBTechvBShout:dbtech_vbshout_command', array('userid' => vB::getUserContext()->fetchUserId()), array('command'), 'commandid');
		foreach ($commands as &$command)
		{
			$command['command'] = vB_String::htmlSpecialCharsUni($command['command']);
			$command['output'] = vB_String::htmlSpecialCharsUni($command['output']);
		}
		return $commands;

Advanced User Tagging Pro v3.0.6 & older for vB3 / vB4

Open /dbtech/usertag_pro/actions/profile.php and find:

$templater->register('hash', $hash['hash']);

Replace with:

$templater->register('hash', htmlspecialchars_uni($hash['hash']));

Sorry for the inconvenience, and thank you for your continued support

Discuss this news here.