PHPBB Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	10738
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 16 2004 12:00AM
Updated:	Jul 16 2004 12:00AM
Credit:	Discovery of these vulnerabilities is credited to Janek Vind <[email protected]>.
Vulnerable:	phpBB Group phpBB 2.0.8 a phpBB Group phpBB 2.0.8
Not Vulnerable:	phpBB Group phpBB 2.0.9

PHPBB Multiple Cross-Site Scripting Vulnerabilities

It is reported that phpBB is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

The problems present themselves in the 'index.php' and 'faq.php' scripts.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

PHPBB Multiple Cross-Site Scripting Vulnerabilities

The following examples are available:
http://www.example.com/phpbb208/index.php?category_rows[0][cat_id]=1&category_rows[0][cat_title]=waraxe<script>alert(document.cookie);</script>&category_rows[0][cat_order]=99

http://www.example.com/phpbb208/faq.php?faq[0][0]=f00<script>alert(document.cookie);</script>bar&faq[0][1]=waraxe

http://www.example.com/phpbb208/faq.php?mode=bbcode&faq[0][0]=f00<script>alert(document.cookie);</script>bar&faq[0][1]=waraxe

PHPBB Multiple Cross-Site Scripting Vulnerabilities

Solution:
It is reported that these vulnerabilities are addressed in phpBB version 2.0.9:


phpBB Group phpBB 2.0.8 a

• phpBB Group phpBB-2.0.9.zip
  http://prdownloads.sourceforge.net/phpbb/phpBB-2.0.9.zip?download

phpBB Group phpBB 2.0.8

• phpBB Group phpBB-2.0.9.zip
  http://prdownloads.sourceforge.net/phpbb/phpBB-2.0.9.zip?download

PHPBB Multiple Cross-Site Scripting Vulnerabilities

References:

• phpBB Homepage (phpBB)
  
• [waraxe-2004-SA#034 - XSS and path full path disclosure in PhpBB 2.0.8] (Janek Vind )