vBulletin 2.2.7/2.2.8 - HTML Injection

source: https://www.securityfocus.com/bid/6337/info

Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.

vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to view a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site hosting the vBulletin forum software.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

This should only be considered an issue if HTML has been enabled in messages. This option is not enabled by default and the vendor recommends that users do not enable it. If the option has been enabled, HTML will not be filtered at all.

*** This vulnerability has been further investigated. It has been reported by the vendor that this functionality is by disabled by default. Additionally, the risks of enabling this feature are documented in the user manual. Therefore, this is not a valid vulnerability, and will be removed from the SecurityFocus Vulnerability Database.

<b onMouseOver="alert(document.location);">Test!</b>