e107 Input Validation Flaw Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1008039
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Oct 30 2003
|
Impact: Denial of service via network
|
Exploit Included: Yes
|
Version(s): confirmed on 0.545 and 0.603
|
Description: An input validation vulnerability was reported in e107. A remote user can deny service to users on certain web pages.
It is reported that the software does not properly filter HTML code from user-supplied input in the "Name:" field of the 'chatbox.php'
script. A remote user can post a message with a specially crafted name value so that the chat page will fail to load for other
users.
A demonstration exploit value is provided:
<script = javascript> alert('DoS') <script>
|
Impact: A remote user can cause pages containing a chat box to fail to load properly.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.e107.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "Blademaster" <blademaster@msbx.net>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 29 Oct 2003 23:12:29 +0100
From: "Blademaster" <blademaster@msbx.net>
Subject: E107 DoS vulnerability
|
Program: E107 (www.e107.org)
Versions: 0.545 & 0.603 tested, below may also be vulnerable
Synopsis: Tagboard Denial of Service vulnerability (system wide)
Security Risk: Medium (It's a system wide DoS)
Author: Blademaster (nielserman@hotmail.com) (www.hackingheaven.com)
URL:
http://www.hackingheaven.com/index.php?name=PNphpBB2&file=viewtopic&t=21
Discovered: October 28, 2003
Published: October 29, 2003
Details:
E107 is a user friendly postnuke/phpnuke like PHP webpage with many features
such as forums, tagboards and user submitted links/downloads/news.
Issue:
An attacker can be capable of Denying access to ANY user of a website using
E107 with the Chatbox.php (tagboard) module enabled. This due to
insufficient filtering of HTML code in the "Name:" editbox on the
Chatbox.php script. However, this is not an XSS exploit, since the normal
main.php module does not execute this code (instead it rejects loading the
whole main.php form)
Exploit:
In the Name inputbox of the Chatbox type:
<script = javascript> alert('DoS') <script>
and put anything in the Message inputbox and submit. Reload the page and you
will only see:
login/register.php
chatbox.php
The rest of the page (any page) will not be loaded. Just this part
Fix:
Since I am no good on PHP, I have not been capable of writing a hotfix,
however, the system is no longer vulnerable if the Chatbox.php module is
DISABLED.
Just wait for a fix from e107 itself.
Vendor Status:
Not notified, haven't found the time yet to do so. (will be notified in at
least 1 day)
sorry for my poor english (dutch guy here :-D)
------
Beer is liquid bread, It's good for you!
Greetz go out to: Legibleskate (testing on his page :-P), MoTT, ROHITAB (for
making such a great community), DaunKnown(www.hackingheaven.com) and every
other script kiddie on www.rohitab.com.
WWW.HACKINGHEAVEN.COM
|
|
