Some vulnerabilities have been reported in vBulletin, which can be exploited by malicious users to conduct SQL injection attacks and potentially compromise a vulnerable system, and by malicious people to conduct cross-site scripting attacks and script insertion attacks.

1) Some input passed in the administration section isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in an administrator's browser session in context of an affected site.

It can also be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when malicious announcement names or forum names are viewed.

2) Some input passed in the administration section isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires administrative privileges.

3) The problem is that it is possible to upload arbitrary files inside the web root via the avatars/icons/smileys upload functionality. This can e.g. be exploited to upload and execute arbitrary PHP scripts.

Successful exploitation requires administrative privileges.

The vulnerabilities have been reported in version 3.0.8 and prior. Other versions may also be affected.

Solution
Some of the vulnerabilities have reportedly been fixed in version 3.0.9.
Further details available to Secunia VIM customers

Provided and/or discovered by
Thomas Waldegger and Doz

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://morph3us.org/advisories/20050917-vbulletin-3.0.8.txt

Deep Links
Links available to Secunia VIM customers