phpBB Smiley Panel Input Validation Flaw Permits Remote Cross-Site Scripting
|
|
SecurityTracker Alert ID: 1007709 |
|
SecurityTracker URL: http://securitytracker.com/id/1007709
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 15 2003
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
|
Description:
An input validation vulnerability was reported in phpBB. A remote authenticated administrator can conduct cross-site scripting attacks against other administrators.
A remote administrator can create a specially crafted smiley panel input so that when a target administrator views the smiley panel, arbitrary scripting code will be executed by the target administrator's browser. The code will originate from the site running the phpBB software and will run in the security context of that site. As a result, the code will be able to access the target administrator's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target administrator.
Some demonstration exploit code (to be placed in the smiley panel) is provided:
:)<script>alert('Css work')</script>
|
Impact:
A remote administrator can access the target administrator's cookies (including authentication cookies), if any, associated with the site running the phpBB software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.phpbb.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 13 Sep 2003 16:22:50 -0000
Subject: PhpBB Admin smiley panel CSS
|
English version :
I found a CSS in Admin smiley panel that can be used like that :
When you're logged as admin if you put a smiley code like that :)<script>alert('Css work')</script> and then any smiley
picture and description, the Admin smiley panel will show the smiley with the following code :) and the smiley picture and description
you wrote before, but a Pop-up will appear saying Css work : Without that pop up it would be impossible for the admin to see that
you inject some javascript in his Admin panel.
It can be exploited (For example cookie stealing) if you make a smiley pack and diffuse it or give it to an admin.
----------------------------------------------------------------
French version : Voilà, j'ai trouvé un CSS dans PhpBB faisable à partir du panel d'administration des smileys :
En mettant comme code Smiley : :)<script>alert('Exploit fonctionnel')</script>
Puis n'importe quel image de smiley et description, le smiley s'affichera normalement sur la page Admin avec comme code :) et affichera
la boîte de dialogue Exploit fonctionnel.
Il suffit alors de créer un pack smiley et de le diffuser ou de donner à un Admin pour le piéger.
Benjamin Tolman (Rituel)
|
|
