Phorum Input Validation Holes in Several Message Fields Let Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1009980
|
|
CVE Reference: CAN-2003-0283
(Links to External Site)
|
Date: Apr 30 2004
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 3.4.3
|
Description: Some input validation vulnerabilities were reported in Phorum in the processing of the 'subject', 'authors name', and 'authors e-mail' message fields. A remote user can conduct cross-site scripting attacks.
In May 2003, WiciU reported that a remote user can insert specially crafted text into the affected message fields to conduct cross-site
scripting attacks. When the malicious message is view by a target user, arbitrary scripting code will be executed by the target
user's browser. The code will originate from the site running the Phorum software and will run in the security context of that site.
As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with
the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the
target user.
Some demonstration exploit content is provided:
<<b>script>alert(document.cookie);<<b>/script>
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
Phorum software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: The vendor released a fixed version (3.4.3).
|
Vendor URL: www.phorum.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: WiciU <vviciu@poczta.onet.pl>
|
Message History:
None.
|
Source Message Contents
|
Date: 2003-05-09 17:37:09
From: WiciU <vviciu@poczta.onet.pl>
Subject: A Phorum's bug...
|
Hi!
I have founded a bug in Phorum (http://phorum.org/).
It is possible to inject script code or other html-tag into "subject",
"author's name" or "author's e-mail" of a message in Phorum.
In the subject (name, e-mail) input of message you need to write any
html-tag like this:
<<b>script>alert(document.cookie);<<b>/script>
I have tested it on Phorum 3.4.1 but probably works in other Phorum 3.x.x
versions.
Greetings!
WiciU, Poland
vviciu@poczta.onet.pl
|
|
