Re: VBulletin AdminCP Index.PHP Multiple Cross-Site Scripting Vulnerability

[kier@xxxxxxxxxxxxx]

I'm somewhat surprised that the reporter does not list the HTML template editor 
as a potential XSS attack vector too. Perhaps he considers uploading files via 
FTP to be a means of attack too?

Yes, we allow *authenticated administrators* to enter HTML for certain values. 
This is the intended behaviour, and should the authenticated site administrator 
wish to include <script> tags in that HTML that is their perogative.

This is not a bug or a security flaw.