{"type": "osvdb", "published": "2004-03-15T04:52:16", "href": "https://vulners.com/osvdb/OSVDB:4312", "hashmap": [{"key": "affectedSoftware", "hash": "7d86917ac9a25fa8e3f10b3096eee4ec"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "41190329a8db5c210cc64c65841f910c"}, {"key": "href", "hash": "c279f743faa5ed8a20797b54ca3aa2f9"}, {"key": "modified", "hash": "4d1eeb7db194ccb8526fd07386a2abdb"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "4d1eeb7db194ccb8526fd07386a2abdb"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "a0d45e254a14f3f5144b3867e436ed88"}, {"key": "title", "hash": "47ce1c776fb04f7f702564d60734b703"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "bulletinFamily": "software", "cvss": {"vector": "NONE", "score": 0.0}, "viewCount": 1, "history": [], "edition": 1, "objectVersion": "1.2", "reporter": "JeiAr(jeiar@gulftech.org)", "title": "vBulletin memberlist.php what Variable XSS", "affectedSoftware": [{"operator": "eq", "version": "2.x", "name": "vBulletin"}], "enchantments": {"score": {"vector": "NONE", "value": 4.3}, "dependencies": {"references": [], "modified": "2017-04-28T13:19:58"}, "vulnersScore": 4.3}, "references": [], "id": "OSVDB:4312", "hash": "9e5112d33e1c9138b28144472364bb7c3f3d5ea070da25b441625d3a667e7246", "lastseen": "2017-04-28T13:19:58", "cvelist": [], "modified": "2004-03-15T04:52:16", "description": "## Vulnerability Description\nvBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the \"what\" variable upon submission to the \"memberlist.php\" script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nvBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the \"what\" variable upon submission to the \"memberlist.php\" script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/memberlist.php?action=getall&what=[XSS]&ltr=&perpage=25&orderby=username\n## References:\nSecurity Tracker: 1009440\n[Secunia Advisory ID:11142](https://secuniaresearch.flexerasoftware.com/advisories/11142/)\n[Related OSVDB ID: 4310](https://vulners.com/osvdb/OSVDB:4310)\n[Related OSVDB ID: 4309](https://vulners.com/osvdb/OSVDB:4309)\n[Related OSVDB ID: 4311](https://vulners.com/osvdb/OSVDB:4311)\nOther Advisory URL: http://www.gulftech.org/03152004b.php\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-03/0147.html\nISS X-Force ID: 15495\nBugtraq ID: 9887\n"}

{}