PT-2006-4147 · Vbulletin Solutions · Vbulletin

Crazy Cracker · Published 2006-06-27 · Updated 2024-08-07 · CVE-2006-3253

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.5.x

Description A cross-site scripting (XSS) issue in member.php allows remote attackers to inject arbitrary web script or HTML via the u parameter. The vendor has disputed this report, stating that they have been unable to replicate the issue and that the userid parameter is run through their filtering system as an unsigned integer.

Recommendations For vBulletin versions 3.5.x, as a temporary workaround, consider restricting access to the member.php file until the issue is resolved. Avoid using the u parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3253

Affected Products

Vbulletin

References · 11

• 🔥 https://exploit-db.com/exploits/28076 · Exploit
• 🔥 http://securitytracker.com/id?1016348 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3253 · Security Note
• http://osvdb.org/27508 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27261 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3253 · Note
• http://securityfocus.com/archive/1/438364/100/100/threaded · Note
• http://securityreason.com/securityalert/1155 · Note
• http://securityfocus.com/archive/1/437817/100/0/threaded · Note
• http://securityfocus.com/bid/18551 · Note
• https://t.me/cvenotify/89788 · Telegram Post