VBulletin Memberlist.PHP Cross Site Scripting Vulnerability

Bugtraq ID:	6226
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 22 2002 12:00AM
Updated:	Nov 22 2002 12:00AM
Credit:	Discovery of this vulnerability credited to Arab VieruZ <[email protected]>.
Vulnerable:	VBulletin VBulletin 2.2.9 VBulletin VBulletin 2.2.8 VBulletin VBulletin 2.2.7 VBulletin VBulletin 2.2.6 VBulletin VBulletin 2.2.5 VBulletin VBulletin 2.2.4 VBulletin VBulletin 2.2.3 VBulletin VBulletin 2.2.2 VBulletin VBulletin 2.2.1 VBulletin VBulletin 2.2 .0 VBulletin VBulletin 2.0.3 VBulletin VBulletin 2.0 rc 3 VBulletin VBulletin 2.0 rc 2
Not Vulnerable:

VBulletin Memberlist.PHP Cross Site Scripting Vulnerability

vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running vBulletin.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

VBulletin Memberlist.PHP Cross Site Scripting Vulnerability

The following proof of concept was provided:

http://www.vbulletin.com/forum/memberlist.php?
s=23c37cf1af5d2ad05f49361b0407ad9e&what=">"
<Scr*ipt>javascript:alert(document.cookie)</Scr*ipt>

• /data/vulnerabilities/exploits/vbulletin-xss.php

VBulletin Memberlist.PHP Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

VBulletin Memberlist.PHP Cross Site Scripting Vulnerability

References:

• Vendor Homepage (Kyberna)
  
• Jelsoft vBulletin 2.2.9 and prior (Arab VieruZ )