XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
BID:4721
Info
XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 4721 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6728 |
| Remote: | Yes |
| Local: | No |
| Published: | May 11 2002 12:00AM |
| Updated: | Jul 20 2009 11:06PM |
| Credit: | Posted to BugTraq on May 11, 2002 by frog frog <[email protected]> |
| Vulnerable: |
The XMB Group XMB Forum 1.6 Magic Lantern MyBB DevBB 1.0 |
| Not Vulnerable: | |
Discussion
XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input.
1. The first involves 'member.php'; submitting script to the variable 'member' in the context of 'action=viewpro' (profile viewing) will cause that script to be returned as an error message.
2. The second involves the 'MSN' information field of a user profile; a registered user can submit script to this field without it being filtered.
3. The third issue can be exploited by submitting a '<script>' tag encoded as '%253Cscript%253E' (note that the percent sign is encoded as '%25', and '3C' and '3E' are the '<' and '>' brackets) to the username variable in the context of 'action=reg' to 'member.php'.
XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input.
1. The first involves 'member.php'; submitting script to the variable 'member' in the context of 'action=viewpro' (profile viewing) will cause that script to be returned as an error message.
2. The second involves the 'MSN' information field of a user profile; a registered user can submit script to this field without it being filtered.
3. The third issue can be exploited by submitting a '<script>' tag encoded as '%253Cscript%253E' (note that the percent sign is encoded as '%25', and '3C' and '3E' are the '<' and '>' brackets) to the username variable in the context of 'action=reg' to 'member.php'.
Exploit / POC
XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
The following examples are copied from frog frog <[email protected]>'s bugtraq post of May 11, 2002.
member.php?action=viewpro&member=<form%20name=o><input%20name=u%20value=XSS></form><script>alert(document.o.u.value)</script>
member.php?action=reg&username=%253Cscript%253E&... .
The following examples are copied from frog frog <[email protected]>'s bugtraq post of May 11, 2002.
member.php?action=viewpro&member=<form%20name=o><input%20name=u%20value=XSS></form><script>alert(document.o.u.value)</script>
member.php?action=reg&username=%253Cscript%253E&... .
Solution / Fix
XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
XMB Forum 1.6 Magic Lantern Cross Site Scripting Vulnerabilities
References:
References:
- XMB Forum Home Page (The XMB Group)
- XMB Image Tag Script Injection Vulnerability (SecurityFocus)