Advanced User Tagging vBulletin - Stored XSS Vulnerability

vendor:

Advanced User Tagging

by:

[]0iZy5

8,8

CVSS

HIGH

Stored XSS

CWE

Product Name: Advanced User Tagging

Affected Version From: vBulletin 3.8.x

Affected Version To: vBulletin 4.x.x

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux & Windows

2013

Advanced User Tagging vBulletin – Stored XSS Vulnerability

Advanced User Tagging vBulletin is vulnerable to a stored XSS vulnerability. An attacker can inject malicious JavaScript code into the 'Hash Tag Subscriptions' page, which is accessible via the UserCP. When a user visits the page, the malicious code will be executed in the user's browser.

Mitigation:

Ensure that user input is properly sanitized and validated before being stored and displayed.

Source

Exploit-DB raw data:

##########################################################################################
#
# Exploit Title: Advanced User Tagging vBulletin - Stored XSS Vulnerability
# Google Dork: intext:usertag_pro
# Date: 10.07.2013
# Exploit Author: []0iZy5
# Vendor Homepage: www.backtrack-linux.ro
# Software Link: http://www.dragonbyte-tech.com/vbecommerce.php?productid=20&do=product
# Version: vBulletin 3.8.x, vBulletin 4.x.x 
# Tested on: Linux & Windows
#
##########################################################################################
#
# Stage 1: Go to -> UserCP -> Hash Tag Subscriptions 
# (Direct Link:) http://127.0.0.1/[path]/usertag.php?do=profile&action=hashsubscription
#
# Stage 2: Add a malicious hash tag.
# (Example:) "><script>alert(document.cookie)</script>
#
##########################################################################################
#
# This was written for educational purpose only. use it at your own risk. 
# Author will be not responsible for any damage caused! user assumes all responsibility.  
# Intended for authorized web application pentesting only! 
#
##########################################################################################