Federico Muttis has reported a vulnerability in vBulletin, which can be exploited by malicious users to conduct script insertion attacks.

Input passed as the subject of a private message is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed.

Successful exploitation requires valid user credentials and that "Show New Private Message Notification Pop-Up" is enabled.

The vulnerability is reported in versions 3.7.2 PL1 and 3.6.10 PL3. Prior versions may also be affected.

Solution
Update to version 3.7.2 PL2 or 3.6.10 PL4.

Provided and/or discovered by
Federico Muttis, Core Security Technologies

Changelog
Further details available to Secunia VIM customers

Original Advisory
vBulletin:
http://www.vbulletin.com/forum/showthread.php?t=282133

Core Security Technologies:
http://www.coresecurity.com/content/vbulletin-cross-site-scripting-vulnerability

Deep Links
Links available to Secunia VIM customers