CVE-2006-3253

vBulletin 3.5.x - Cross-Site Scripting via User ID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-3253. PoCs published by CrAzY.CrAcKeR.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in vBulletin, where user-supplied input via the 'u' parameter in member.php is not properly sanitized. The vendor disputes the claim, stating the parameter is sanitized before use.

Description

Cross-site scripting (XSS) vulnerability in member.php in vBulletin 3.5.x allows remote attackers to inject arbitrary web script or HTML via the u parameter. NOTE: the vendor has disputed this report, stating that they have been unable to replicate the issue and that "the userid parameter is run through our filtering system as an unsigned integer.

Exploits (1)

exploitdb WRITEUP VERIFIED
by CrAzY.CrAcKeR · textwebappsphp
https://www.exploit-db.com/exploits/28076

The provided text describes a cross-site scripting (XSS) vulnerability in vBulletin, where user-supplied input via the 'u' parameter in member.php is not properly sanitized. The vendor disputes the claim, stating the parameter is sanitized before use.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: vBulletin (version not specified)
No auth needed
Prerequisites: Access to a vulnerable vBulletin instance · Ability to craft a malicious URL with the 'u' parameter
MITRE ATT&CK
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/27508
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/437817/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1155
Exploit vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016348
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27261
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/438364/100/100/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18551

Scores

EPSS 0.0200
EPSS Percentile 78.7%

Details

Status published
Products (11)
jelsoft/vbulletin 3.5.0
jelsoft/vbulletin 3.5.0_beta_1
jelsoft/vbulletin 3.5.0_beta_2
jelsoft/vbulletin 3.5.0_beta_3
jelsoft/vbulletin 3.5.0_beta_4
jelsoft/vbulletin 3.5.0_rc1
jelsoft/vbulletin 3.5.0_rc2
jelsoft/vbulletin 3.5.0_rc3
jelsoft/vbulletin 3.5.1
jelsoft/vbulletin 3.5.2
... and 1 more
Published Jun 28, 2006
Tracked Since Feb 18, 2026