Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
XMB Forum Input Validation Flaw in 'buddy.php' Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1007035
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 23 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 1.8, 1.9
|
Description: An input validation hole was reported in XMB Forum in the 'buddy.php' script. A remote user can conduct cross-site scripting attacks.
SecuriTeam reported that the 'action' field of the 'buddy.php' script does not properly filter user-supplied input. A remote user
can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the
target user's browser. The code will originate from the site running XMB Forum and will run in the security context of that site.
As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with
the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the
target user.
A demonstration exploit URL is provided:
http://pathto/XMBforum/buddy.php?action=<
script>alert(document.cookie)</script>&buddy=<script
>alert(document.cookie)</script>
The vendor has reportedly been notified.
SecuriTeam credits thanh duong <knight4vn@yahoo.com>
with reporting this flaw.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
XMB Forum software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: No solution was available at the time of this entry. According to the report, the vendor plans to issue a fix.
|
Vendor URL: www.xmbforum.com/home/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: SecuriTeam <support@securiteam.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 23 Jun 2003 10:44:59 +0200
From: SecuriTeam <support@securiteam.com>
Subject: [UNIX] XSS Vulnerabilities Found in XMB Forum
|
The following security advisory is sent to the securiteam mailing list, and can be found at the Secur
iTeam web site: http://www.securiteam.com
- - promotion
Beyond Security in Canada
Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
We welcome ISPs, system integrators and IT systems resellers
to promote the most advanced vulnerability assessment solutions today.
Contact us at 416-482-0038 or at canadasales@beyondsecurity.com
- - - - - - - - -
XSS Vulnerabilities Found in XMB Forum
------------------------------------------------------------------------
SUMMARY
<http://www.xmbforum.com/> XMB Forum is "a free web-based bulletin board
system written in PHP with a MySQL backend". Multiple cross site scripting
vulnerabilities have been found in the XMB Forum, these vulnerabilities
would allow attackers to insert malicious HTML and JavaScript code into
existing web pages.
DETAILS
Vulnerable systems:
* XMB Forum version 1.8
* XMB Forum version 1.9
Examples:
http://pathto/XMBforum/member.php?action=viewpro&member=admin<
script>alert(document.cookie)</script>
http://pathto/XMBforum/buddy.php?action=<
script>alert(document.cookie)</script>&buddy=<script
>alert(document.cookie)</script>
Vendor status:
The vendor has been contacted. A fixed version is scheduled to be
released.
ADDITIONAL INFORMATION
The information has been provided by <mailto:knight4vn@yahoo.com> thanh
duong.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@secu
riteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.co
m
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, con
sequential, loss of business
profits or special damages.
|
|
Go to the Top of This SecurityTracker Archive Page
|
