Jelsoft VBulletin Board HTML Posting Cross-Scripting Vulnerability

Bugtraq ID:	4008
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 31 2002 12:00AM
Updated:	Jan 31 2002 12:00AM
Credit:	This vulnerability was announced by HarryM <[email protected]> via Bugtraq on January 31, 2002.
Vulnerable:	Jelsoft vBulletin 2.2 .0 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Microsoft IIS 5.0 - Microsoft IIS 4.0 - Microsoft IIS 3.0
Not Vulnerable:	VBulletin VBulletin 2.2.1

Jelsoft VBulletin Board HTML Posting Cross-Scripting Vulnerability

vBulletin is a web-based bulletin board system. It is distributed and maintained by Jelsoft Enterprises.

It is possible to execute malicious script code in the context of the site hosting the bulletin board. This is due to vBulletin inadequately sanitizing input to the board. This could allow a board user to post malicious script code that could be used to redirect users to other pages, pop up other sites, or steal cookies. This could also result in the theft of credentials, allowing a user to gain access to the board as another user.

Jelsoft VBulletin Board HTML Posting Cross-Scripting Vulnerability

This vulnerable may be exploited with a web browser.

Jelsoft VBulletin Board HTML Posting Cross-Scripting Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Jelsoft VBulletin Board HTML Posting Cross-Scripting Vulnerability

References:

• vBulletin Homepage (vBulletin)