Related information

Web applications security vulnerabilities (PHP, ASP, CGI, Perl, etc)

XSS in PBLang 4.65 Profile.php/UCP.php

[SA17706] PHP-Post Cross-Site Scripting and Script Insertion Vulnerabilities

[SA17741] blogBuddies Cross-Site Scripting Vulnerabilities

[SA17736] SmartPPC Pro "username" Cross-Site Scripting Vulnerability

From:	r0t <krustevs_(at)_googlemail.com>
Date:	26.11.2005
Subject:	VBulletin 3.5.1 XSS vuln.

VBulletin 3.5.1 XSS vuln.

Vuln. dicovered by : r0t
Date: 26 nov. 2005
Orginal advisory:http://pridels.blogspot.com/2005/11/vbulletin-351-xss-vuln.html
Vendor:http://www.vbulletin.com/
affected version:3.5.1 and prior

Vuln. Description:

"editavatar" XSS-
avatar url field parameters isn't properly sanitised before being
returned to the user. This can be exploited to execute arbitrary HTML
and script code in a user's browser session in context of an affected
site


example:
http://www.(javascript:
alert());"<script>alert('r0t XSS')</script>.com/.jpg





Solution:
Edit the source code to ensure that input is properly sanitised.