MyBB Input Validation Flaw in 'usercp.php' Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1015535 |
|
SecurityTracker URL: http://securitytracker.com/id/1015535
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 24 2006
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 1.x
|
Description:
Roozbeh Afrasiabi reported a vulnerability in MyBB. A remote user can conduct cross-site scripting attacks.
The 'usercp.php' script does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted request that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the MyBB software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
The 'notepad' parameter is affected via a POST submission.
A demonstration exploit URL and parameter value is provided:
http://[target]/usercp.php?action=notepad
notepad=</textarea><script>alert(document.cookie)</script>
The 'signature' parameter is affected via a POST submission.
A demonstration exploit URL and parameter value is provided:
http://[target]/usercp.php?action=editsig
signature=</textarea><script>alert(document.cookie)</script>
The original advisory is available at:
http://kapda.ir/advisory-241.html
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the MyBB software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.mybboard.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 24 Jan 2006 10:01:25 -0800 (PST)
Subject: MyBB 1.x Cross_Site_Scripting
|
[KAPDA::#25] - MyBB 1.x Cross_Site_Scripting
KAPDA New advisory
Vulnerable products : MYBB 1.x
Vendor: www.mybboard.net/
Risk: medium
Vulnerabilities: Cross_Site_Scripting
Discoverd by Roozbeh Afrasiabi
www.persiax.com
Date :
--------------------
Found : Jan 21 2006
Vendor Contacted : N/A
Release Date : N/A
About :
--------------------
MyBB is a powerful, efficient and free forum package
developed in PHP and MySQL.MyBB
has been designed with the end users in mind, you and
your subscribers. Full control
over your discussion system is p resented right at
the tip of your fingers, from
multiple styles and themes to the ultimate
customisation of your forums using the
template system.
Vulnerability:
--------------------
Cross_Site_Scripting (XSS,CSS):
MYBB is affected by a cross-site scripting
vulnerability. This issue
is due to the failure of the application to properly
sanitize user-
supplied input.
As a result of this vulnerability, it is possible for
a remote attacker
to create a malicious link containing script code that
will be executed
in the browser of an unsuspecting user when followed.
Detail and PoC :
--------------------
1)
The application does not validate the "notepad"
variable upon submission
to the usercp.php script via the POST method.The
personal pad would save
this data which would later be displayed to the
user(i.e on visiting
the persoanal pad page).
h**p://[target]/usercp.php?action=notepad
notepad=</textarea><script>alert(document.cookie)</script>
2)
This flaw exists because the application does not
validate the "signature"
variable upon submission to the usercp.php script via
the POST method.
h**p://[target]/usercp.php?action=editsig
signature=</textarea><script>alert(document.cookie)</script>
Solution :
--------------------
N/A
Original Advisory :
--------------------
http://kapda.ir/advisory-241.html
Credit :
--------------------
Discoverd by Roozbeh Afrasiabi
roozbeh_afrasiabi[at]yahoo.com
black_death[at]kapda.ir
www.persiax.com
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
|
|
