Comment Board Message Field Input Validation Flaws Permit Remote Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1007811
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 25 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Description: A vulnerability was reported in Comment Board. A remote user can conduct cross-site scripting attacks.
It is reported that the software does not filter HTML from the user-supplied Topic Title, Name and Message fields. A remote user
can submit a specially crafted message that, when viewed by a target user, will cause arbitrary scripting code to be executed by
the target user's browser. The code will originate from the site running the Comment Board software and will run in the security
context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies),
if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on
the site acting as the target user.
The vendor has reportedly been notified.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
Comment Board software, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.ymonda.co.uk/ProductDetails.aspx?productID=416&selection=6 (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: Bahaa Naamneh <b_naamneh@hotmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 24 Sep 2003 20:43:20 -0000
From: Bahaa Naamneh <b_naamneh@hotmail.com>
Subject: Comment Board XSS Vulnerability
|
Comment Board XSS Vulnerability
Published: 24 September 2003
Released: 24 September 2003
Affected Systems: Comment Board
Vendor: http://www.ymonda.co.uk
Issue: Remote attackers can inject XSS script.
Description:
============
"Comment Board works straight away with little or no configuration required and
provides a wealth of exciting features that will keep your web site visitors
coming back for more. Check out our online demo and try a free downloadable
version now."
Details:
========
It's possibile to inject XSS script in the Topic Title, Name and Message fields.
Examples:
"><script> this code will hide every thing after it including the the board top
ics
if any attacker write it in the topic title.
<script>windows.open("URL");</script> this code will open a new
window when the
board loaded.
Solution:
=========
The vendor has been contacted and a patch is not yet produced.
Suggestions:
============
Filter all variables.
Discovered by / credit:
=======================
Bahaa Naamneh
b_naamneh@hotmail.com
http://www.bsecurity.tk
|
|
