the css found when you uploading a file to the server by the "atteched file" function..
in ipb you can upload some HTML file,in the html file write this:
<script>alert('Css found By V[i]RuS');</script>
when someone will click on the attechment file the script will run.
sry about my poor english..
bug discoverd V[i]RuS
tested succesfully on ipb 1.0.3 all the vers should be vuln =]
Resultaten 1 tot 3 van de 3
Onderwerp: ipb Css bug(now public)
ipb Css bug(now public)
Re: ipb Css bug(now public)While IPB < 1.3 *might* have been vulnerable, IPB 2.x definitely isn't as HTML files are saved with the mime-type "unknown/unknown" which prompts the user to download the file to their desktop making it totally safe.
08/08/05 20:35Nicolas Gregoire
Re: ipb Css bug(now public)Le lundi 08 août 2005 à 13:12 +0000, email@example.com a écrit :
> While IPB < 1.3 *might* have been vulnerable, IPB 2.x definitely isn't
> as HTML files are saved with the mime-type "unknown/unknown" which
> prompts the user to download the file to their desktop making it
> totally safe.
That may be not true for users using (at least) Internet Explorer, as
"MIME-type sniffing" will be used to determine the file type (and
handler) to use when opening the file.
That's what happen in some Oracle web pages sent with "text/plain" and
vulnerable to a text/code/JS injection. Oracle isn't to blame (really ?)
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
firstname.lastname@example.org ------[ ExaProbe ]------ http://www.exaprobe.com/
PGP KeyID:CA61B44F FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B4 4F