CVE-2005-3025: XSS

Published Sep 21, 2005

Updated

Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.0.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the loc parameter to (1) modcp/index.php or (2) admincp/index.php, or the ip parameter to (3) modcp/user.php or (4) admincp/usertitle.php.

Affected Software

33 affected components

Jelsoft vBulletin=2.2.0

Jelsoft vBulletin=2.0_rc2

Jelsoft vBulletin=3.0.4

Jelsoft vBulletin=3.0_beta_6

Jelsoft vBulletin=2.3.0

Jelsoft vBulletin=2.3.2

Jelsoft vBulletin=3.0.1

Jelsoft vBulletin=2.0_rc3

Jelsoft vBulletin=3.0.6

Jelsoft vBulletin=2.2.1

Jelsoft vBulletin=2.2.7

Jelsoft vBulletin=2.0.3

Jelsoft vBulletin=3.0_beta_7

Jelsoft vBulletin=3.0_beta_3

Jelsoft vBulletin=2.2.4

Jelsoft vBulletin=3.0_beta_2

Jelsoft vBulletin=2.2.2

Jelsoft vBulletin=2.2.5

Jelsoft vBulletin=2.2.6

Jelsoft vBulletin=3.0.2

Jelsoft vBulletin=3.0_gamma

Jelsoft vBulletin=2.2.9

Jelsoft vBulletin=3.0.7

Jelsoft vBulletin=3.0_beta_4

Jelsoft vBulletin=3.0.3

Jelsoft vBulletin=1.0.1

Jelsoft vBulletin=3.0.5

Jelsoft vBulletin=2.2.8

Jelsoft vBulletin=2.3.4

Jelsoft vBulletin=2.2.3

Jelsoft vBulletin=3.0

Jelsoft vBulletin=3.0_beta_5

Jelsoft vBulletin=2.3.3

Remediation

Patch Available

http://morph3us.org/advisories/20050917-vbulletin-3.0.7.txt

Event History

Sep 21, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3025?

CVE-2005-3025 is classified as a moderate severity vulnerability due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2005-3025?

To fix CVE-2005-3025, you should upgrade to a newer, patched version of vBulletin that resolves the cross-site scripting vulnerabilities.

What versions of vBulletin are affected by CVE-2005-3025?

CVE-2005-3025 affects vBulletin versions 3.0.7 and earlier, including multiple earlier versions.

Can CVE-2005-3025 lead to data theft?

Yes, exploitation of CVE-2005-3025 can allow attackers to steal cookies or session tokens, potentially leading to unauthorized access.

What are the implications of CVE-2005-3025 for website administrators?

Website administrators should be aware that CVE-2005-3025 exposes their forums to risks of malicious script execution, affecting user security.