Jelsoft vBulletin up to 2.2.9 Can Error Message member2.php $perpage Reflected numeric error

Summaryinfo

A vulnerability marked as problematic has been reported in Jelsoft vBulletin up to 2.2.9 Can. Affected by this vulnerability is an unknown functionality of the file member2.php of the component Error Message Handler. The manipulation of the argument $perpage leads to numeric error (Reflected). This vulnerability is uniquely identified as CVE-2002-2235. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in Jelsoft vBulletin up to 2.2.9 Can (Forum Software) and classified as problematic. This issue affects an unknown code of the file member2.php of the component Error Message Handler. The manipulation of the argument $perpage with an unknown input leads to a numeric error vulnerability (Reflected). Using CWE to declare the problem leads to CWE-189. Impacted is confidentiality. The summary by CVE is:

member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.

The weakness was disclosed 12/31/2002 (Website). The advisory is shared at online.securityfocus.com. The identification of this vulnerability is CVE-2002-2235 since 10/14/2007. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known.

The exploit is available at securityfocus.com. It is declared as proof-of-concept. By approaching the search of inurl:member2.php it is possible to find vulnerable targets with Google Hacking. The commercial vulnerability scanner Qualys is able to test this issue with plugin 10931 (VBulletin members2.php Cross Site Scripting Vulnerability).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (10701), Exploit-DB (22042) and SecurityFocus (BID 6246†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Forum Software

Vendor

• Jelsoft

Name

• vBulletin

Version

• 2.0
• 2.0.1
• 2.0.2
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.2.9 Can

License

• commercial

Website

• Vendor: https://www.vbulletin.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion