Re: vBulletin<<--v3.5.X "member.php" Cross Site Scripting

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: vBulletin<<--v3.5.X "member.php" Cross Site Scripting
From: scott@xxxxxxxxxxxxx
Date: 23 Jun 2006 10:36:28 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

We are unable to reproduce this on any of the 3.5.x series or 3.6.x development 
branch. The userid parameter is run through our filtering system as an unsigned 
integer.

'userid' => TYPE_UINT

Prev by Date: Re: PHP security (or the lack thereof)
Next by Date: Re: PHP security (or the lack thereof)
Previous by thread: vBulletin<<--v3.5.X "member.php" Cross Site Scripting
Next by thread: [MajorSecurity #18] Ralf Image Gallery <=0.7.4 - Multiple XSS, Remote File Include and directory traversal vulnerabilities
Index(es):
- Date
- Thread