Simple Machines Forum 'image/bmp' MIME Type HTML Injection Vulnerability
BID:35130
Info
Simple Machines Forum 'image/bmp' MIME Type HTML Injection Vulnerability
| Bugtraq ID: | 35130 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2009 12:00AM |
| Updated: | May 28 2009 06:19PM |
| Credit: | Jacques Copeau |
| Vulnerable: |
Simple Machines SMF 1.1.7 Simple Machines SMF 1.1.5 Simple Machines SMF 1.1.5 Simple Machines SMF 1.1.4 Simple Machines SMF 1.1.3 Simple Machines SMF 1.1.2 Simple Machines SMF 1.1.1 Simple Machines SMF 1.1 rc3 Simple Machines SMF 1.1 rc3 Simple Machines SMF 1.1 rc2 Simple Machines SMF 1.1 rc1 Simple Machines SMF 1.1 final Simple Machines Simple Machines Forum 1.1.8 Simple Machines Simple Machines Forum 1.1.8 Simple Machines Simple Machines Forum 1.1.7 Simple Machines Simple Machines Forum 1.1.6 Simple Machines Simple Machines Forum 1.1.5 Simple Machines Simple Machines Forum 1.1.4 Simple Machines Simple Machines Forum 1.1.3 Simple Machines Simple Machines Forum 1.1.2 Simple Machines Simple Machines Forum 1.1.1 Simple Machines Simple Machines Forum 2.0 RC1 |
| Not Vulnerable: |
Simple Machines Simple Machines Forum 1.1.9 Simple Machines Simple Machines Forum 2.0 RC1-1 |
Discussion
Simple Machines Forum 'image/bmp' MIME Type HTML Injection Vulnerability
Simple Machines Forum (SMF) is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
NOTE: This issue was originally documented as a cross-site scripting vulnerability. After further analysis, the BID has been rewritten as an HTML-injection issue.
Simple Machines Forum (SMF) is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
NOTE: This issue was originally documented as a cross-site scripting vulnerability. After further analysis, the BID has been rewritten as an HTML-injection issue.
Exploit / POC
Simple Machines Forum 'image/bmp' MIME Type HTML Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Simple Machines Forum 'image/bmp' MIME Type HTML Injection Vulnerability
Solution:
The vendor has released updates. Please see the references for details.
Solution:
The vendor has released updates. Please see the references for details.
References
Simple Machines Forum 'image/bmp' MIME Type HTML Injection Vulnerability
References:
References:
- Simple Machines SMF Homepage (Simple Machines)
- SMF 1.1.9 and 2.0 RC1-1 released (Simple Machines)
- Survey: "MIME/Content-Type-Sniffing" Issues in Image Uploads in Forum Scripts (Jacques Copeau