Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

XSS Vulnerability in FTD v3.7.3

[Full-disclosure] PHPCodeCabinet Vulnerability

Tinyportal Shoutbox

phpAutoMembersArea 3.2.5 ($installed_confi g_file) Remote File Inclusion

From:	imei <addmimistrator_(at)_gmail.com>
Date:	07.08.2006
Subject:	vBulletin 3.0.14 ~ init.php~ registerring global arbitary variable~ XSS exploit

ORIGINAL ADVISORY:

http://myimei.com/security/2006-07-24/vbulletin-3014-initphp-XSS-exploit.html
http://www.kapda.ir/advisory-397.html

VENDOR CREDIT:
http://www.vbulletin.com/forum/showthread.php?t=194062
——–Summary——–
Software: vBulletin
Sowtware’s Web Site: http://www.vBulletin.com
Versions: 3.0.14
Exploit: Available
Solution: Available
Discovered by: imei addmimistrator
Risk Level: Mediume
——-Description——-
There is a security bug in most powerfull & common forum software vBulletin version 3.0.14 that allows attacker performe a XSS attack without any limitation.

FOR MORE DETAILES VISIT ORIGINAL ADVISORIES