vBulletin '$newpm[title]' Parameter Cross-Site Scripting Vulnerability

Bugtraq ID:	30777
Class:	Input Validation Error
CVE:	CVE-2008-3773
Remote:	Yes
Local:	No
Published:	Aug 20 2008 12:00AM
Updated:	May 07 2015 05:24PM
Credit:	CORE
Vulnerable:	VBulletin VBulletin 3.7.2 PL1 VBulletin VBulletin 3.6.10 PL3
Not Vulnerable:	VBulletin VBulletin 3.7.2 PL2 VBulletin VBulletin 3.6.10 PL4

vBulletin '$newpm[title]' Parameter Cross-Site Scripting Vulnerability

vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

vBulletin 3.7.2 Patch Level 1 and vBulletin 3.6.10 Patch Level 3 are vulnerable; other versions may also be affected.

vBulletin '$newpm[title]' Parameter Cross-Site Scripting Vulnerability

An attacker can exploit this issue by tricking an unsuspecting user into opening a malicious private message.

The follwing proof-of-concept code will execute when included in the title of a private message:

--></script><script>alert(/xss/.source)</script><!--

vBulletin '$newpm[title]' Parameter Cross-Site Scripting Vulnerability

Solution:
The vendor has released fixes. Please see the references for more information.

vBulletin '$newpm[title]' Parameter Cross-Site Scripting Vulnerability

References:

• vBulletin 3.7.2 PL2 / vBulletin 3.6.10 PL4 Released (vBulletin)
  
• vBulletin Homepage (vBulletin)
  
• vBulletin Member Updates (vBulletin)
  
• CORE-2008-0813 - vBulletin Cross Site Scripting Vulnerability (CORE Security Technologies Advisories
• CORE-2008-0813: vBulletin Cross Site Scripting Vulnerability (CORE)