PT-2006-4147 · Vbulletin Solutions · Vbulletin

Crazy Cracker · Publicado 2006-06-27 · Atualizado 2024-08-07 · CVE-2006-3253

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.5.x

Description A cross-site scripting (XSS) issue in member.php allows remote attackers to inject arbitrary web script or HTML via the u parameter. The vendor has disputed this report, stating that they have been unable to replicate the issue and that the userid parameter is run through their filtering system as an unsigned integer.

Recommendations For vBulletin versions 3.5.x, as a temporary workaround, consider restricting access to the member.php file until the issue is resolved. Avoid using the u parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-3253

Produtos afetados

Vbulletin

Referências · 11

• 🔥 https://exploit-db.com/exploits/28076 · Exploit
• 🔥 http://securitytracker.com/id?1016348 · Exploit
• http://osvdb.org/27508 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27261 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3253 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3253 · Nota
• http://securityfocus.com/archive/1/438364/100/100/threaded · Nota
• http://securityreason.com/securityalert/1155 · Nota
• http://securityfocus.com/archive/1/437817/100/0/threaded · Nota
• http://securityfocus.com/bid/18551 · Nota
• https://t.me/cvenotify/89788 · Publicação no Telegram