Onderwerp: www.proboards.com / YaBB XSS Vuln

A Cross Site scripting vulnerability exists currently for all boards of the ever popular www.proboards.com which has code based off of the popular YaBB Forums.

This can result in an attacker stealing users Cookie Information and possible defacing/hijacking of the message board and its users accounts on the message board.

The following code can be used to execute this XSS vuln:

http://WEBSITE/index.cgi?board=[BOARDNAME]&action=display&num=[VALID TOPIC NUMBER]&"><script>alert(document.cookie);</script>

Be Cautious of suspicous looking links.

##################################
# -LJ Lemke leetflash@yahoo.com #
##################################

In-Reply-To: <20040915231242.3251.qmail@www.securityfocus.com>

This flaw has been fixed.

I would like to take this opportunity to first state that ProBoards does not run on YaBB software as the author of this thread implies. We run on our own in-house developed software, which the YaBB team will vouch for.

Also I would like to note that we were not notified of this vulnerability until last last night, nearly 24 hours after it was posted here. I respectfully request of the author of this post to first contact the vendor as is the standard courtesy for these
situations. Not contacting the vendor first is irresponsible.

Patrick Clinger
ProBoards.com

>Received: (qmail 10060 invoked from network); 16 Sep 2004 20:37:50 -0000
>Received: from mail2.securityfocus.com (205.206.231.1)
> by mail.securityfocus.com with SMTP; 16 Sep 2004 20:37:50 -0000
>Received: (qmail 18319 invoked by alias); 16 Sep 2004 20:18:24 -0000
>Delivered-To: archive-bugtraq@securityfocus.com
>Received: (qmail 18302 invoked from network); 16 Sep 2004 20:18:24 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26)
> by mail2.securityfocus.com with SMTP; 16 Sep 2004 20:18:24 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing2.securityfocus.com (Postfix) with QMQP
> id 37B7E143E09; Thu, 16 Sep 2004 09:24:09 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 29611 invoked from network); 15 Sep 2004 16:58:21 -0000
>Date: 15 Sep 2004 23:12:42 -0000
>Message-ID: <20040915231242.3251.qmail@www.securityfocus.com>
>Content-Type: text/plain
>Content-Disposition: inline
>Content-Transfer-Encoding: binary
>MIME-Version: 1.0
>X-Mailer: MIME-tools 5.411 (Entity 5.404)
>From: <admin@leetflash.com>
>To: bugtraq@securityfocus.com
>Subject: www.proboards.com / YaBB XSS Vuln
>
>
>
>A Cross Site scripting vulnerability exists currently for all boards of the ever popular www.proboards.com which has code based off of the popular YaBB Forums.
>
>This can result in an attacker stealing users Cookie Information and possible defacing/hijacking of the message board and its users accounts on the message board.
>
>The following code can be used to execute this XSS vuln:
>
>http://WEBSITE/index.cgi?board=[BOARDNAME]&action=display&num=[VALID TOPIC NUMBER]&">&lt;script&gt;alert(document.cookie);&lt;/script&gt;
>
>Be Cautious of suspicous looking links.
>
>##################################
># -LJ Lemke leetflash@yahoo.com #
>##################################
>

Do ProBoards use YaBB, or did they just mod the YaBB code to be their own?
Either way having a look at this

http://www.securityfocus.com/bid/5078/exploit/

Kinda leads me to believe that more vulns exist in ProBoards that have been
addressed in YaBB? (as the invalid topic xss in YaBB is kinda old)

While we are on the topic of YaBB though, here are a few vulns in YaBB that
I never really made public until now. I don't think anyone else has reported
them yet anyway.

http://host/YaBB.pl?board=;action=im...script%3Ealert(document
..cookie)%3C/script%3E

This is XSS in all versions I believe, and am sure at least up to YaBB 1
Gold - SP 1.3.1

Another issue with YaBB is it is full of CSRF holes which leads to forced
command execution. This allows an attacker to do things like delete peoples
inbox's, delete posts, pin topics, lock topics, and much much more. I think
out of all the CSRF holes in YaBB the worst is probably this.

http://host/YaBB.pl?board=;action=mo...E;moda=Remove2

Put that in an image tag and you can kill a board as soon as an admin views
your post or PM's as this will delete entire categories and everything in
it.

But yeah man, if ProBoards are using the YaBB codebase they should
definitely implement some strict session auth or something as it is one of
the most insecure message board apps I can think of.

James


-----Original Message-----
From: admin@leetflash.com [mailto:admin@leetflash.com]
Sent: Wednesday, September 15, 2004 6:13 PM
To: bugtraq@securityfocus.com
Subject: www.proboards.com / YaBB XSS Vuln



A Cross Site scripting vulnerability exists currently for all boards of the
ever popular www.proboards.com which has code based off of the popular YaBB
Forums.

This can result in an attacker stealing users Cookie Information and
possible defacing/hijacking of the message board and its users accounts on
the message board.