Html_Injection in vBulletin 3.5.2
Vulnerable Version: 3.5.2 (prior versions also may be affected) Bug:
Html_Injection (Second order Cross_Site_Scripting) Exploitation: Remote with
browser
Html_Injection : The software does not properly filter HTML tags in the title
of events before being passed to user in 'calendar.php'&'reminder.php AS
include'. that may allow a remote user to inject HTML/javascript codes to
events of calendar. The hostile code may be rendered in the web browser of the
victim user who will Request Reminder for those Events (persistent). For
example an attacker creates new event (Single-All Day Event , Ranged Event OR
Recurring Event)with this content:
TITLE:--------->Test<script>alert(document.cookie)</script> BODY:---------->No
matter OTHER OPTIONS:->No matter
Demonstration XSS URL: --------------------
http://example.com/vbulletin/calendar.php?do=addreminder&e=[eventid]
Credit
Savsak.com [Ejder And The_BeKiR And Liz0Zim And CyberLord]