{"href": "https://vulners.com/osvdb/OSVDB:38023", "id": "OSVDB:38023", "reporter": "OSVDB", "published": "2004-02-13T00:00:00", "description": "## Manual Testing Notes\nhttp://[target]/forum/search.php?do=process&showposts=0&query=<script>alert('XSS')</script>\n## References:\nISS X-Force ID: 15208\n[CVE-2004-2076](https://vulners.com/cve/CVE-2004-2076)\nBugtraq ID: 9656\n", "title": "vBulletin search.php query Variable XSS", "lastseen": "2017-04-28T13:20:34", "bulletinFamily": "software", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "references": [], "edition": 1, "cvelist": ["CVE-2004-2076"], "affectedSoftware": [], "viewCount": 4, "enchantments": {"score": {"value": 5.4, "vector": "NONE", "modified": "2017-04-28T13:20:34", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2004-2076"]}, {"type": "nessus", "idList": ["JELSOFT_VBULLETIN_XSS.NASL"]}, {"type": "exploitdb", "idList": ["EDB-ID:23691"]}], "modified": "2017-04-28T13:20:34", "rev": 2}, "vulnersScore": 5.4}, "modified": "2004-02-13T00:00:00"}

{"cve": [{"lastseen": "2021-02-02T05:23:00", "description": "Cross-site scripting (XSS) vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.", "edition": 4, "cvss3": {}, "published": "2004-12-31T05:00:00", "title": "CVE-2004-2076", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2004-2076"], "modified": "2017-07-11T01:31:00", "cpe": ["cpe:/a:jelsoft:vbulletin:3.0.0_rc4"], "id": "CVE-2004-2076", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-2076", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:jelsoft:vbulletin:3.0.0_rc4:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2016-02-02T21:35:02", "description": "VBulletin 3.0 Search.PHP Cross-Site Scripting Vulnerability. CVE-2004-2076. Webapps exploit for php platform", "published": "2004-02-13T00:00:00", "type": "exploitdb", "title": "VBulletin 3.0 - Search.PHP Cross-Site Scripting Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2004-2076"], "modified": "2004-02-13T00:00:00", "id": "EDB-ID:23691", "href": "https://www.exploit-db.com/exploits/23691/", "sourceData": "source: http://www.securityfocus.com/bid/9656/info\r\n\r\nIt has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'search.php' script. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.\r\n\r\nhttp://www.example.com/forum/search.php?do=process&showposts=0&query=<!-- / main error message --></p></p></blockquote>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<script>alert('XSS')</script><plaintext>\r\n\r\nhttp://www.example.com/forum/search.php?do=process&showposts=0&query=<script>alert('XSS')</script>", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/23691/"}], "nessus": [{"lastseen": "2021-01-20T11:36:09", "description": "There is a cross-site scripting issue in vBulletin that may allow an\nattacker to steal a user's cookies.", "edition": 26, "published": "2004-02-16T00:00:00", "title": "vBulletin search.php query Parameter XSS", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2004-2076"], "modified": "2004-02-16T00:00:00", "cpe": [], "id": "JELSOFT_VBULLETIN_XSS.NASL", "href": "https://www.tenable.com/plugins/nessus/12058", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif(description)\n{\n script_id(12058);\n script_version(\"1.23\");\n script_cve_id(\"CVE-2004-2076\");\n script_bugtraq_id(9649, 9656);\n \n script_name(english:\"vBulletin search.php query Parameter XSS\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host contains a PHP application that is vulnerable to a\ncross-site scripting attack.\" );\n script_set_attribute(attribute:\"description\", value:\n\"There is a cross-site scripting issue in vBulletin that may allow an\nattacker to steal a user's cookies.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.securityfocus.com/archive/1/353869\" );\n script_set_attribute(attribute:\"solution\", value:\n\"Unknown at this time.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2004/02/16\");\n script_set_attribute(attribute:\"vuln_publication_date\", value: \"2004/02/13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\nscript_set_attribute(attribute:\"plugin_type\", value:\"remote\");\nscript_end_attributes();\n\n \n script_summary(english:\"Checks for JelSoft VBulletin\");\n script_category(ACT_ATTACK);\n script_copyright(english:\"This script is Copyright (C) 2004-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\"); \n script_family(english:\"CGI abuses : XSS\");\n script_dependencies(\"vbulletin_detect.nasl\", \"cross_site_scripting.nasl\");\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_require_ports(\"Services/www\", 80);\n script_require_keys(\"www/PHP\");\n exit(0);\n}\n\n# The script code starts here\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\n\nport = get_http_port(default:80);\n\nif(!get_port_state(port))exit(0);\nif(!can_host_php(port:port))exit(0);\n\n# Test an install.\ninstall = get_kb_item(string(\"www/\", port, \"/vBulletin\"));\nif (isnull(install)) exit(0);\nmatches = eregmatch(string:install, pattern:\"^(.+) under (/.*)$\");\nif (!isnull(matches)) {\n d = matches[2];\n test_cgi_xss(port: port, cgi: \"/search.php\", dirs: make_list(d),\n qs: \"do=process&showposts=0&query=<script>foo</script>\",\n pass_re: \"<script>foo</script>\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}]}