CVE-2005-3020
vBulletin < 3.0.9 - Cross-Site Scripting via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2005-3020. PoCs published by [email protected].
AI-analyzed exploit summary The provided text describes multiple XSS vulnerabilities in vBulletin due to insufficient input sanitization. It includes example URLs demonstrating how arbitrary script code could be executed in the context of the affected site.
Description
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin before 3.0.9 allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter to css.php, (2) redirect parameter to index.php, (3) email parameter to user.php, (4) goto parameter to language.php, (5) orderby parameter to modlog.php, and the (6) hex, (7) rgb, or (8) expandset parameter to template.php.
Exploits (6)
The provided text describes multiple XSS vulnerabilities in vBulletin due to insufficient input sanitization. It includes example URLs demonstrating how arbitrary script code could be executed in the context of the affected site.
The provided text describes multiple XSS vulnerabilities in vBulletin due to insufficient input sanitization in the admincp/template.php script. The writeup includes example URLs demonstrating the vulnerabilities but does not contain executable exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in vBulletin, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code via the 'orderby' parameter in the admin control panel.
The provided text describes a cross-site scripting (XSS) vulnerability in vBulletin, specifically in the admincp/language.php endpoint. It lacks executable exploit code but details the vulnerability and potential impact.
The provided text describes multiple XSS vulnerabilities in vBulletin due to insufficient input sanitization. It includes example URLs demonstrating the vulnerabilities but does not contain executable exploit code.
The provided text describes a cross-site scripting (XSS) vulnerability in vBulletin, where user-supplied input is not properly sanitized. The example URL demonstrates how an attacker could inject arbitrary script code into the browser of an unsuspecting user.