bugtraq - vBulletin 3.0.14 ~ init.php~ registerring global arbitary variable~ XSS exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060805023854.11136.qmail@securityfocus.com>
Date: 5 Aug 2006 02:38:54 -0000
From: addmimistrator@...il.com
To: bugtraq@...urityfocus.com
Subject: vBulletin 3.0.14 ~ init.php~ registerring global arbitary
 variable~ XSS exploit

ORIGINAL ADVISORY:

http://myimei.com/security/2006-07-24/vbulletin-3014-initphp-XSS-exploit.html
http://www.kapda.ir/advisory-397.html

VENDOR CREDIT:
http://www.vbulletin.com/forum/showthread.php?t=194062
——–Summary——–
Software: vBulletin
Sowtware’s Web Site: http://www.vBulletin.com
Versions: 3.0.14
Exploit: Available
Solution: Available
Discovered by: imei addmimistrator
Risk Level: Mediume
——-Description——-
There is a security bug in most powerfull & common forum software vBulletin version 3.0.14 that allows attacker performe a XSS attack without any limitation.

FOR MORE DETAILES VISIT ORIGINAL ADVISORIES