UBBCentral UBB.threads Multiple Cross-Site Scripting Vulnerabilities
BID:11900
Info
UBBCentral UBB.threads Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 11900 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 13 2004 12:00AM |
| Updated: | Dec 13 2004 12:00AM |
| Credit: | dw. and ms. are credited with the discovery of these issues. |
| Vulnerable: |
UBBCentral UBB.threads 6.5 UBBCentral UBB.threads 6.2.3 |
| Not Vulnerable: | |
Discussion
UBBCentral UBB.threads Multiple Cross-Site Scripting Vulnerabilities
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.
Exploit / POC
UBBCentral UBB.threads Multiple Cross-Site Scripting Vulnerabilities
Example URIs sufficient to exploit these vulnerabilities have been provided:
http://www.example.com/showflat.php?Cat=document.write(unescape("%3CSCRIPT%3Ealert%28document.domain%29%3B%3C/SCRIPT%3E%3CSCRIPT%3Ealert%28document.cookie%29%3B%3C/SCRIPT%3E%0D%0A"));
http://www.example.com/calendar.php?Cat=[XSS]
http://www.example.com/login.php?Cat=[XSS]
http://www.example.com/online.php?Cat=[XSS]
Example URIs sufficient to exploit these vulnerabilities have been provided:
http://www.example.com/showflat.php?Cat=document.write(unescape("%3CSCRIPT%3Ealert%28document.domain%29%3B%3C/SCRIPT%3E%3CSCRIPT%3Ealert%28document.cookie%29%3B%3C/SCRIPT%3E%0D%0A"));
http://www.example.com/calendar.php?Cat=[XSS]
http://www.example.com/login.php?Cat=[XSS]
http://www.example.com/online.php?Cat=[XSS]
Solution / Fix
UBBCentral UBB.threads Multiple Cross-Site Scripting Vulnerabilities
Solution:
Some of these issues may have been fixed in version 6.5 of the affected package.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Some of these issues may have been fixed in version 6.5 of the affected package.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
UBBCentral UBB.threads Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- UBB.threads Homepage (UBBCentral)