CVE-2006-1040 - Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to in

CVE-2006-1040

Summary

Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php. This vulnerability affects all versions of Jelsoft, vBulletin between 3.0.12 and 3.5.3

References

Vulnerable Configurations

cpe:2.3:a:jelsoft:vbulletin:3.0.12:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.0.12:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.5.3:*:*:*:*:*:*:*
cpe:2.3:a:jelsoft:vbulletin:3.5.3:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 18-10-2018 - 16:30)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:N/A:N

refmap via4

bid	16919
bugtraq	20060301 [KAPDA::#26]vBulletin.3.5.3~3.0.12-XSS 20060302 vBulletin3.0.12&3.5.3~is_valid_email()~XSS Attack
confirm	http://www.vbulletin.com/forum/showthread.php?postid=1079030
misc	http://www.kapda.ir/advisory-266.html
osvdb	23614
secunia	19100
vupen	ADV-2006-0808

Last major update

18-10-2018 - 16:30

Published

07-03-2006 - 11:02

Last modified

18-10-2018 - 16:30