Invision Power Board SSI.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	10539
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 14 2004 12:00AM
Updated:	Jun 14 2004 12:00AM
Credit:	Discovery is credited to IMAN Sharafoddin <[email protected]>.
Vulnerable:	Invision Power Services Invision Board 1.3 Final
Not Vulnerable:

Invision Power Board SSI.PHP Cross-Site Scripting Vulnerability

Invision Power Board 'ssi.php' script reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization performed by functions in the 'ssi.php' script on user-influenced 'f' parameter. This can permit the theft of cookie-based authentication credentials; other attacks may also be possible.

Invision Power Board SSI.PHP Cross-Site Scripting Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/hyper/ssi.php?a=out&type=xml&f=<script>alert("ALOooooooooo");</script>

Invision Power Board SSI.PHP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Invision Power Board SSI.PHP Cross-Site Scripting Vulnerability

References:

• Invision Board Homepage (Invision Power Services)