PHPBB URL BBCode HTML Injection Vulnerability

Bugtraq ID:	8570
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2003 12:00AM
Updated:	Sep 08 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to <[email protected]>.
Vulnerable:	phpBB Group phpBB 2.0.6
Not Vulnerable:

PHPBB URL BBCode HTML Injection Vulnerability

phpBB BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of phpBB where BBCode is rendered, for example, bulletin board posts or private messages. This issue is due to a lack of sufficient sanitization performed on user supplied URL BBCode tags.

An attacker may exploit this issue to steal cookie-based authentication credentials; other attacks may also be possible.

PHPBB URL BBCode HTML Injection Vulnerability

The following proof of concept has been supplied:

[url=http://www.example.com" onclick="alert('Hello')]text[/url]

[url=http://www.example.com" onclick=alert("bug");"]test[/url]

PHPBB URL BBCode HTML Injection Vulnerability

Solution:
The vendor has released a fix to address this issue. Please see the workaround section and referenced web page for more information.

PHPBB URL BBCode HTML Injection Vulnerability

References:

• Fix for phpBB BBCode Vulnerability (phpBB)
  
• Re: XSS vulnerability in phpBB (an other ;-) (Victor Sheldeshov )
  
• Re: XSS vulnerability in phpBB (an other ;-) ("John Smith" )
  
• Re: XSS vulnerability in phpBB (an other ;-) (Michael Renzmann )
  
• Re: XSS vulnerability in phpBB (an other ;-) ()
  
• Re: XSS vulnerability in phpBB (an other ;-) ()
  
• XSS vulnerability in phpBB (an other ;-) ()