Secunia

Some vulnerabilities have been reported in vBulletin, which can be exploited by malicious people to conduct script insertion attacks.

Input passed via "PHP_SELF" or via the "do" parameter when requesting a missing page is not properly sanitised before being logged. This can be exploited to insert arbitrary HTML and script code, which is executed in an administrator's browser session in context of an affected site when the malicious logs are being viewed.

NOTE: Reportedly, the vulnerabilities can be exploited to inject and execute arbitrary PHP code on an affected system.

The vulnerabilities are reported in version 3.7.2 and 3.6.10 PL2. Prior versions may also be affected.

Solution
Update to version 3.7.2 PL1 or 3.6.10 PL3.

Provided and/or discovered by
Jessica Hope and anonymous persons

Changelog
Further details available in Customer Area

Original Advisory
vBulletin:
http://www.vbulletin.com/forum/showthread.php?t=277945

Jessica Hope:
http://seclists.org/fulldisclosure/2008/Jul/0067.html

Deep Links
Links available in Customer Area