Aerosol Posted February 14, 2015 Report Share Posted February 14, 2015 *CVE-2014-9469 vBulletin XSS (Cross-Site Scripting) SecurityVulnerabilities*Exploit Title: vBulletin XSS (Cross-Site Scripting) Security VulnerabilitiesProduct: vBulletin ForumVendor: vBulletinVulnerable Versions: 5.1.3 5.0.5 4.2.2 3.8.7 3.6.7 3.6.0 3.5.4Tested Version: 5.1.3 4.2.2Advisory Publication: Feb 12, 2015Latest Update: Feb 12, 2015Vulnerability Type: Cross-Site Scripting [CWE-79]CVE Reference: CVE-2014-9469CVSS Severity (version 2.0):CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)Impact Subscore: 2.9Exploitability Subscore: 8.6Credit: Wang Jing [Mathematics, Nanyang Technological University, Singapore]*Advisory Details:**(1) Vendor & Product Description:**Vendor:*vBulletin*Product & Version: *vBulletin Forum5.1.3 5.0.5 4.2.2 3.8.7 3.6.7 3.6.0 3.5.4*Vendor URL & Download: *vBulletin can be downloaded from here,https://www.vbulletin.com/purchases/*Product Introduction:*"vBulletin (vB) is a proprietary Internet forum software package developedby vBulletin Solutions, Inc., a division of Internet Brands. It is writtenin PHP and uses a MySQL database server.""Since the initial release of the vBulletin forum product in 2000, therehave been many changes and improvements. Below is a list of the majorrevisions and some of the changes they introduced. The current productionversion is 3.8.7, 4.2.2, and 5.1.3."*(2) Vulnerability Details:*vBulletin has a security problem. It can be exploited by XSS attacks.*(2.1) *The vulnerability occurs at "forum/help" page. Add "hash symbol"first. Then add script at the end of it.*References:*http://tetraph.com/security/cves/cve-2014-9469-vbulletin-xss-cross-site-scripting-security-vulnerabilities/http://securityrelated.blogspot.com/2015/02/cve-2014-9469-vbulletin-xss-cross-site.htmlhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9469http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9469https://security-tracker.debian.org/tracker/CVE-2014-9469http://www.cvedetails.com/cve/CVE-2014-9469/http://www.security-database.com/detail.php?alert=CVE-2014-9469http://packetstormsecurity.com/files/cve/CVE-2014-9469http://www.pentest.it/cve-2014-9469.htmlhttp://www.naked-security.com/cve/CVE-2014-9469/http://www.inzeed.com/kaleidoscope/cves/cve-2014-9469/http://007software.net/cve-2014-9469/http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/cve-2014-9469/https://computertechhut.wordpress.com/2015/02/12/cve-2014-9469/https://security-tracker.debian.org/tracker/CVE-2014-9469--Wang Jing,Division of Mathematical Sciences (MAS),School of Physical and Mathematical Sciences (SPMS),Nanyang Technological University (NTU),Singapore.http://www.tetraph.com/wangjing/https://twitter.com/justqdjingSource Quote Link to comment Share on other sites More sharing options...
Nytro Posted February 14, 2015 Report Share Posted February 14, 2015 Cred ca asta fusese raportat si de noi. Quote Link to comment Share on other sites More sharing options...