E107 DoS vulnerability

• Previous message: Chris Wysopal: "Re: Mac OS X vulnerabilities ['Virus checked"]"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: <bugtraq@securityfocus.com>
Date: Wed, 29 Oct 2003 23:12:29 +0100

Program: E107 (www.e107.org)
Versions: 0.545 & 0.603 tested, below may also be vulnerable
Synopsis: Tagboard Denial of Service vulnerability (system wide)
Security Risk: Medium (It's a system wide DoS)
Author: Blademaster (nielserman@hotmail.com) (www.hackingheaven.com)
URL:
http://www.hackingheaven.com/index.php?name=PNphpBB2&file=viewtopic&t=21
Discovered: October 28, 2003
Published: October 29, 2003

Details:
E107 is a user friendly postnuke/phpnuke like PHP webpage with many features
such as forums, tagboards and user submitted links/downloads/news.

Issue:
An attacker can be capable of Denying access to ANY user of a website using
E107 with the Chatbox.php (tagboard) module enabled. This due to
insufficient filtering of HTML code in the "Name:" editbox on the
Chatbox.php script. However, this is not an XSS exploit, since the normal
main.php module does not execute this code (instead it rejects loading the
whole main.php form)

Exploit:
In the Name inputbox of the Chatbox type:

<script = javascript> alert('DoS') <script>

and put anything in the Message inputbox and submit. Reload the page and you
will only see:

login/register.php
chatbox.php

The rest of the page (any page) will not be loaded. Just this part

Fix:
Since I am no good on PHP, I have not been capable of writing a hotfix,
however, the system is no longer vulnerable if the Chatbox.php module is
DISABLED.
Just wait for a fix from e107 itself.

Vendor Status:
Not notified, haven't found the time yet to do so. (will be notified in at
least 1 day)

sorry for my poor english (dutch guy here :-D)
------

Beer is liquid bread, It's good for you!
Greetz go out to: Legibleskate (testing on his page :-P), MoTT, ROHITAB (for
making such a great community), DaunKnown(www.hackingheaven.com) and every
other script kiddie on www.rohitab.com.

WWW.HACKINGHEAVEN.COM

• Previous message: Chris Wysopal: "Re: Mac OS X vulnerabilities ['Virus checked"]"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]