Phpclanwebsite BBCode IMG Tag Script Injection Vulnerability

Bugtraq ID:	16300
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 28 2005 12:00AM
Updated:	Feb 07 2006 08:55PM
Credit:	Kurdish Hacker is credited with the discovery of this vulnerability.
Vulnerable:	Phpclanwebsite Phpclanwebsite 1.23.1
Not Vulnerable:

Phpclanwebsite BBCode IMG Tag Script Injection Vulnerability

Phpclanwebsite is prone to a script-injection vulnerability.

An attacker can nest BBCode IMG tags to trigger this issue and execute arbitrary code in a user's browser.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. Other attacks are also possible.

Reports have not specified which version is vulnerable. The current version (1.23.1) is assumed to be vulnerable; other versions may also be affected.

Phpclanwebsite BBCode IMG Tag Script Injection Vulnerability

No exploit is required.

The following proof of concept is available:

[img]javascript:alert('XSS')[/img]

Phpclanwebsite BBCode IMG Tag Script Injection Vulnerability

Solution:

The vendor has released a fix to address this issue:


Phpclanwebsite Phpclanwebsite 1.23.1

• Phpclanwebsite Phpclanwebsite_1231_fix.rar
  http://www.phpclanwebsite.com/index.php?page=downloads

Phpclanwebsite BBCode IMG Tag Script Injection Vulnerability

References:

• PCW 1.23.1 Security Fix (Phpclanwebsite)
  
• Phpclanwebsite Web Site (Phpclanwebsite)
  
• Phpclanwebsite BBCode IMG Tag XSS Vulnerability ( [email protected])