PT-2002-2947 · Vbulletin Solutions · Vbulletin

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2235

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: vBulletin versions 2.2.9 and earlier

Description: The issue arises from the improper restriction of the $perpage variable to be an integer in the member2.php file. This causes an error message to be reflected back to the user without proper quoting, facilitating cross-site scripting (XSS) and possibly other attacks.

Recommendations: For vBulletin versions 2.2.9 and earlier, ensure that the $perpage variable is properly validated and restricted to integer values to prevent potential attacks. As a temporary workaround, consider implementing input validation for the $perpage variable to mitigate the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2002-2235

Affected Products

Vbulletin

References · 7

• 🔥 https://exploit-db.com/exploits/22042 · Exploit
• 🔥 http://securityreason.com/securityalert/3229 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/301076 · Exploit
• 🔥 http://securityfocus.com/bid/6246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2235 · Security Note
• http://iss.net/security_center/static/10701.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2235 · Note