Reply to thread

Really? This is just a serious vulnerability, and well, if you understand what you are giving to a person or you really have a real team assembled. But you do not know that every person in the head and at any moment he may want to do a dirty trick. And okay, this is all the lyrics. Additions to XenForo can also contain XSS vulnerabilities and even in XenForo they are. And what will this vulnerability give us? But the fact is that XenForo contains a session identifier in the cookie and there are scripts thanks to which you can log in using the session identifier as an administrator. It is enough for the user to find the vulnerability due to which he will receive this session further and will be able to further go to the database thanks to this magic function that will open him access. When this feature is available in development or debugging mode then this will reduce the attacker's chances of gaining access.