Re: XSS vulnerability in phpBB (an other ;-)
Date: 9 Sep 2003 17:10:06 -0000 To: email@example.com('binary' encoding is not supported, stored as-is) In-Reply-To: <firstname.lastname@example.org>
>Tuesday, September 9, 2003, 1:43:59 AM, you wrote:
>kyf> Hello, i've just found a new xss vulnerability in
phpBB 2.0.6 (i'm not
>kyf> sure but i don't think that others versions are
>kyf> This vulnerability is located in the [url][/url]
>kyf> [url=www.google.fr" onclick=alert('Hello')]text[/url]
> Think, my phpBB 2.0.5 is not vulnerable.
> I posted "[url=www.google.fr"
> the body of the post. No URL link appeared, but I saw
> string "[url=www.google.fr"
onclick=alert('Hello')]text[/url]" in my
> Was I wrong? Where do we need to place that string?
All 2.0.x are vulnerable - that string is missing
quote the beginning of the string and the end of it
on it's own (so your quote at the end should not be
Although browsers will ignore onclick for A, they won't
ignore onblur and so on. So yes, it's vulnerable.
The fix is somewhat simple though, I don't see why
the phpBB folks are taking so long, this is a critical
-- Omer Efraim