https://www.exploit-db.com/exploits/21946
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-306

JelsoftvBulletin2.0.0到2.2.8版本global.php存在跨站脚本攻击(XSS)漏洞。远程攻击者借助(1)$scriptpath或(2)$url变量注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/5997/info

vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running vBulletin.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. 

http://<victim>/usercp.php?s=[Session ID]"><Script>alert(document.cookie);</Script>

来源:BID
名称:5997
链接:http://www.securityfocus.com/bid/5997
来源:XF
名称:vBulletin-usercp-xss(10407)
链接:http://www.iss.net/security_center/static/10407.php
来源:BUGTRAQ
名称:20021018vBulletinXSSSecurityBug
链接:http://archives.neohapsis.com/archives/bugtraq/2002-10/0272.html