XMB Forum Allows Cross-Site Scripting Attacks
|
Date: Feb 23 2002
|
Impact: Disclosure of authentication information, Execution of arbitrary code via network
|
Exploit Included: Yes
|
Version(s): 1.6x Magic Lantern and prior
|
Description: A vulnerability was reported in the XMB Forum web-based bulletin board software. A remote user can conduct cross-site scripting attacks against XMB Forum users.
It is reported that a remote user can submit HTML code containing javascript into messages posted on the forum. Then, when another
target user (i.e., the victim) views the message, the javascript will be executed by the target user's browser. This code will
appear to originate from the site running the XMB Forum software and will run in the security context of that site. As a result,
the code may be able to access the target user's cookies associated with that web site.
The following is demonstration exploit
code:
[img]javasCript:alert('Hello world.')[/img]
|
Impact: A remote user can cause arbitrary javascript to be executed on another user's browser. The code may be able to access the other user's cookies associated with the web site running XMB Forum.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.xmbforum.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Underlying OS Comments: PHP-based
|
Reported By: skizzik@imail.ru
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 22 Feb 2002 17:00:58 +0300
From: skizzik@imail.ru
Subject: XMB cross-scripting vulnerability
|
XMB is a php-based forum. This product contain a
Cross Site Scripting vulnerability that allows
attackers to insert JavaScript code (and other HTML
code) into existing messages, bypassing the internal
JavaScript/HTML code stripper.
Exploit:
[img]javasCript:alert('Hello world.')[/img]
Vulnerable systems:
All versions of XMB board, including last version -
XMB 1.6x Magic Lantern
Immune systems:
None
Possible solution:
Searching the image URL for the text "javascript:"
should solve the problem
SliderGod.
|
|
