vBulletin 'url' Parameter URI Redirection Vulnerability

Bugtraq ID:	57118
Class:	Input Validation Error
CVE:	CVE-2011-5251
Remote:	Yes
Local:	No
Published:	Dec 31 2012 12:00AM
Updated:	Dec 31 2012 12:00AM
Credit:	Robert Gilbert of HALOCK Security Labs
Vulnerable:	VBulletin VBulletin 4.1.12 PL3 VBulletin VBulletin 4.1.12 PL2 VBulletin VBulletin 4.1.12 VBulletin VBulletin 4.1.10 VBulletin VBulletin 4.1.3 VBulletin VBulletin 4.1.2 PL1 VBulletin VBulletin 4.1.11 VBulletin VBulletin 4.1.1 PL1 VBulletin VBulletin 4.1.0 PL3
Not Vulnerable:

vBulletin 'url' Parameter URI Redirection Vulnerability

vBulletin is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

vBulletin 4.1.3 and prior are vulnerable.

vBulletin 'url' Parameter URI Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

vBulletin 'url' Parameter URI Redirection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

vBulletin 'url' Parameter URI Redirection Vulnerability

References:

• Potential Phishing Vector (vBulletin)
  
• vBulletin Homepage (vBulletin)