Re: XSS vulnerability in phpBB (an other ;-)

omere_at_hushmail.com
Date: 09/09/03

  • Next message: Darren Pilgrim: "Re: 11 years of inetd default insecurity?" 
    Date: 9 Sep 2003 17:10:06 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is) In-Reply-To: <19084321117.20030909100957@mail.ru>

    >Tuesday, September 9, 2003, 1:43:59 AM, you wrote:
    >
    >kyf> Hello, i've just found a new xss vulnerability in
    phpBB 2.0.6 (i'm not
    >kyf> sure but i don't think that others versions are
    vulnerable).
    >kyf> This vulnerability is located in the [url][/url]
    bbcode.
    >kyf> You can insert javascript by doing a thing like that:
    >kyf> [url=www.google.fr" onclick=alert('Hello')]text[/url]
    >
    > Think, my phpBB 2.0.5 is not vulnerable.
    > I posted "[url=www.google.fr"
    onclick=alert('Hello')]text[/url]" into
    > the body of the post. No URL link appeared, but I saw
    the whole
    > string "[url=www.google.fr"
    onclick=alert('Hello')]text[/url]" in my
    > post.
    >
    > Was I wrong? Where do we need to place that string?

    All 2.0.x are vulnerable - that string is missing
    a quote before the javascript code, as phpBB will
    quote the beginning of the string and the end of it
    on it's own (so your quote at the end should not be
    there either).

    Although browsers will ignore onclick for A, they won't
    ignore onblur and so on. So yes, it's vulnerable.
    The fix is somewhat simple though, I don't see why
    the phpBB folks are taking so long, this is a critical
    bug. 

    --
Omer Efraim
  • Next message: Darren Pilgrim: "Re: 11 years of inetd default insecurity?"

    Relevant Pages