ReBB Image Tag Cross-Agent Scripting Vulnerability
BID:4220
Info
ReBB Image Tag Cross-Agent Scripting Vulnerability
| Bugtraq ID: | 4220 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0413 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 04 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | This issue was reported to BugTraq by <[email protected]>. |
| Vulnerable: |
ReBB ReBB 1.0 |
| Not Vulnerable: | |
Discussion
ReBB Image Tag Cross-Agent Scripting Vulnerability
ReBB is web forum software which will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is written in PHP and may be back-ended by a number of databases.
ReBB allows users to include images in forum messages using image tags, with the following syntax:
[img]url of image[/img]
It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials.
ReBB is web forum software which will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is written in PHP and may be back-ended by a number of databases.
ReBB allows users to include images in forum messages using image tags, with the following syntax:
[img]url of image[/img]
It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials.
Exploit / POC
ReBB Image Tag Cross-Agent Scripting Vulnerability
This condition may be reproduced with the following example:
[img]javascript:alert('test')[/img]
This condition may be reproduced with the following example:
[img]javascript:alert('test')[/img]
Solution / Fix
ReBB Image Tag Cross-Agent Scripting Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.