CVE-2002-2235 Information

Description

member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer which causes an error message to be reflected back to the user without quoting which facilitates cross-site scripting (XSS) and possibly other attacks.

Reference

http://online.securityfocus.com/archive/1/301076 http://securityreason.com/securityalert/3229 http://www.iss.net/security_center/static/10701.php http://www.securityfocus.com/bid/6246