vBulletin is a powerful and widely used bulletin board system, based on PHP language and MySQL database. Sp IC discovered lately a Cross-Site Scripting issue that would allow attackers to inject maleficent codes into the pages and execute it on the client's browser.
Vulnerable systems:
* Jelsoft vBulletin 2.2.9 Release Candidate and prior
Vulnerable systems:
* Jelsoft vBulletin 2.2.9 Final
At "Start View Threads" block in member2.php, there is a variable [$perpage] controls the way of reciting subscribed threads, therefore an integer value [Which refers to the number of threads that will be displayed each page] should be assigned for the variable. However, we should realize that the value of this variable is added to a query that will fetch records from the database, so if a client gave a wrong value to $perpage, the script will output an error message [Due to script doesn't checks on inputs and filter it], printing the query and revealing its mistake.
Exploit:
- Run this script on some host:
<?PHP
// vBulletin XSS Injection Vulnerability: Exploit
// ---
// Coded By : Sp.IC (SpeedICNet@Hotmail.Com).
// Descrption: Fetching vBulletin's cookies and storing it into a log file.
