vBulletin 3.8.4 & 3.8.5 Registration Bypass Vulnerability

vendor:

vBulletin

by:

Immortal Boy

N/A

CVSS

N/A

Registration Bypass

N/A

CWE

Product Name: vBulletin

Affected Version From: 3.8.4

Affected Version To: 3.8.5

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Multiple

2010

vBulletin 3.8.4 & 3.8.5 Registration Bypass Vulnerability

Go to Http://[localhost]/path/register.php, assume that forum admin user name is ADMIN, type this at User Name ===> ADMIN&#00, &#00 is an ASCII Code, and complete the other parameters, then click on Complete Registrarion, now you see that your user name like admin user name, after this time the private messages to the user (ADMIN) to sending see for you is sending.

Mitigation:

Go to AdminCP, click on vBulletin Options and choose vBulletin Options, choose Censorship Options, type &# in Censored Words section, then click on Save.

Source

Exploit-DB raw data:

===============================================================
vBulletin 3.8.4 & 3.8.5 Registration Bypass Vulnerability
===============================================================


   010101010101010101010101010101010101010101010101010101010   
   0                                                       0
   1  Iranian Datacoders Security Team 2010                1
   0                                                       0
   010101010101010101010101010101010101010101010101010101010
 

# Exploit Title: vBulletin 3.8.4 & 3.8.5 Around Registration Vulnerability
# Date: 29/08/2010                            
# Author: Immortal Boy                     
# Software Link: http://www.vbulletin.org
# Version: 3.8.4 & 3.8.5
# Google dork 1 : powered by vBulletin 3.8.4
# Google dork 2 : powered by vBulletin 3.8.5
# Platform / Tested on: Multiple
# Category: webapplications
# Code : N/A
 
#  BUG :  #########################################################################
 
1 > Go to Http://[localhost]/path/register.php

2 > Assume that forum admin user name is ADMIN

3 > Type this at User Name ===> ADMIN&#00

4 > &#00 is an ASCII Code

5 > And complete the other parameters

6 > Then click on Complete Registrarion

7 > Now you see that your user name like admin user name
 
After this time the private messages to the user (ADMIN) to sending see for you is sending .


#  Patch :  #######################################################################

1 > Go to AdminCP

2 > Click on vBulletin Options and choose vBulletin Options

3 > Choose Censorship Options

4 > type &# in Censored Words section

5 > Then click on Save

#############################################################################

Our Website : http://www.datacoders.ir
 
Special Thanks to : H-SK33PY , NEO , Sp|R|T , BigB4NG , 3r1ck , Dr.mute ,

hosinn , NIK , uones , mohammad_ir &  all iranian datacoders members
 
#############################################################################