VBulletin Profile mizmization function HTML injection vulnerability and repair

Affected Versions:
VBulletin 4.0.8

Vulnerability description:

VBulletin is an open-source PHP Forum program.

The Profile mizmization function of vBulletin has the persistent cross-site scripting vulnerability. In the Custom Field of the configuration file, you can enter the color code, rgb code, and graphics. Because the url () function does not properly filter user input, vBulletin is affected by cross-site scripting attacks.

. <* Reference
Html> http://forum.intern0t.net/intern0t-advisories/3349-vbulletin-4-0-8-persistent-cross-site-scripting-via-profile-customization.html
*>
Test method:

Url (</script> )
Url (/); background: url (javascript: document. write (1337 ))
Url (/); width: expression (alert (www.intern0t.net) SEBUG Security suggestions:
Vendor patch:

VBulletin
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.vbulletin.com/

Www.2cto.com solution: the url () function correctly filters user input.