Nessus Plugin #16280

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

vBulletin XSS(3)

Family:

CGI abuses : XSS

Category:

infos

Copyright:

This script is Copyright (C) 2005 David Maciejak

Summary:

Checks BBTag XSS flaw in vBulletin

Version:

$Revision: 1.3 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

OSVDB:13150

Description:

The remote host is running vBulletin, a web based bulletin board system
written in PHP.

The remote version of this software seems to be prior or equal to version 2.3.5
or 3.0.5.
These versions are vulnerable to a cross-site scripting issue, due to a
failure of the application to properly sanitize user-supplied URI input.

As a result of this vulnerability, it is possible for a remote attacker
to create a malicious link containing script code that will be executed
in the browser of an unsuspecting user when followed.

This may facilitate the theft of cookie-based authentication credentials
as well as other attacks.

Solution : Upgrade to versoin 2.3.6 or 3.0.6
Risk factor : Medium