bugtraq - vbulletin.com Multiple XSS Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 10 Jun 2006 20:48:22 -0000
From: chris@...ices.org
To: bugtraq@...urityfocus.com
Subject: vbulletin.com Multiple XSS Vulnerabilities

Multiple XSS Vulnerabilities exist in vbulletin.com's website that allow the attacker to gain sensitive credentials for authentication himself as a user on the forum and site.

The first problem lies in the the site's Sales Form for opening an issue ticket.  Proper sanitation of variables passed via the "Full Name" field allows a user to inject:

<script src="evilxss.js></script>

The issue, being actually in something that looks like this:

http://www.vbulletin.com/issue.php?issueid=379455&authcode=e09e0afd

That link isn't a representation of this vuln, but moreless the output given after you submit an issue id and where the xss is viewable.

2.)  Another xss lies in the online Invoice Display.  If you go to pricing and ordering and then create a fake purchase, selecting Invoice as your chosen method of payment, it will give you an option to "view" your invoice online.  All variables passed via input fields are NOT sanitized when displayed to screen via this method.  For example:

http://www.vbulletin.com/r.php?p=3E411875588B&a=f72c600cd7358bf596b4b1dea9ffb7ed&inv=1

That is a current invoice displaying an alert box with document.cookie.  If that link isnt available  at time of reading this, to recreate simply sign up to buy vbulletin and pay by invoice, your name is <script>alert(document.cookie);</script> - it will give you a link to view your invoice and there ya go ;)

This XSS allows for session theft on vbulletin.com's forums along with access to information ran under the context as a member on the website.

For a live demonstration that was anonymously submitted to me by an individual who confirmed this vulnerability and strictly for informational purposes only - where this was done in a testing environment - visit:

http://www.splices.org/ret/xssvid.html

Please enable sound.

Discovered by:  
splices
www.splices.org
www.securident.com