Title: vBulletin '$newpm[title]' Parameter Cross-Site Scripting Vulnerability
Severity: MODERATE
Description:
vBulletin is PHP-based forum software.
The application is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to the '$newpm[title]' parameter before displaying it on private messages presented to users.
NOTE: The 'Show New Private Message Notification Pop-Up' option must be enabled before this flaw can be exploited.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
vBulletin 3.7.2 Patch Level 1 and vBulletin 3.6.10 Patch Level 3 are vulnerable; other versions may also be affected.
Affected Products:
- VBulletin VBulletin 3.6.10 PL3
- VBulletin VBulletin 3.7.2 PL1
References:
- CORE: CORE-2008-0813: vBulletin Cross Site Scripting Vulnerability
- vBulletin: vBulletin Homepage
- vBulletin: vBulletin Member Updates