PT-2006-2077 · Vbulletin · Vbulletin

Published 2006-03-07 · Updated 2018-10-18 · CVE-2006-1040

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.0.12 and 3.5.3

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the email field. This field is not properly sanitized when used in sendmsg.php, although it is injected in profile.php.

Recommendations For version 3.0.12, update the sendmsg.php file to properly sanitize the email field. For version 3.5.3, update the sendmsg.php file to properly sanitize the email field.

Exploit

Fix

Related Identifiers

CVE-2006-1040

Affected Products

Vbulletin

References · 11

• 🔥 http://kapda.ir/advisory-266.html · Exploit
• 🔥 https://exploit-db.com/exploits/27343 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1040 · Security Note
• http://vbulletin.com/forum/showthread.php?postid=1079030 · Note
• http://osvdb.org/23614 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1040 · Note
• http://securityfocus.com/archive/1/426589/100/0/threaded · Note
• http://secunia.com/advisories/19100 · Note
• http://securityfocus.com/archive/1/426537/100/0/threaded · Note
• http://securityfocus.com/bid/16919 · Note
• http://vupen.com/english/advisories/2006/0808 · Note