{"edition": 1, "title": "vBulletin admincp/index.php vb_login_username Variable XSS", "bulletinFamily": "software", "published": "2004-03-15T04:52:16", "lastseen": "2017-04-28T13:20:00", "modified": "2004-03-15T04:52:16", "reporter": "JeiAr(jeiar@gulftech.org)", "viewCount": 7, "href": "https://vulners.com/osvdb/OSVDB:5567", "description": "## Vulnerability Description\nvBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the \"vb_login_username\" variable upon submission to the \"admincp/index.php\" script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nvBulletin contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the \"vb_login_username\" variable upon submission to the \"admincp/index.php\" script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/admincp/index.php?vb_login_username=[XSS]\n## References:\nVendor URL: http://www.vbulletin.com/\n[Secunia Advisory ID:11142](https://secuniaresearch.flexerasoftware.com/advisories/11142/)\n[Related OSVDB ID: 4310](https://vulners.com/osvdb/OSVDB:4310)\n[Related OSVDB ID: 5568](https://vulners.com/osvdb/OSVDB:5568)\n[Related OSVDB ID: 4312](https://vulners.com/osvdb/OSVDB:4312)\n[Related OSVDB ID: 4309](https://vulners.com/osvdb/OSVDB:4309)\n[Related OSVDB ID: 4311](https://vulners.com/osvdb/OSVDB:4311)\nOther Advisory URL: http://www.gulftech.org/03152004b.php\nBugtraq ID: 9943\n", "affectedSoftware": [{"name": "vBulletin", "version": "3.0.0 RC4", "operator": "eq"}], "type": "osvdb", "references": [], "enchantments": {"score": {"value": -0.2, "vector": "NONE", "modified": "2017-04-28T13:20:00", "rev": 2}, "dependencies": {"references": [], "modified": "2017-04-28T13:20:00", "rev": 2}, "vulnersScore": -0.2}, "cvss": {"vector": "NONE", "score": 0.0}, "cvelist": [], "id": "OSVDB:5567"}

{}