bugtraq - Re: XSS vulnerability in phpBB (an other ;-)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 9 Sep 2003 17:10:06 -0000
From: <omere@...hmail.com>
To: bugtraq@...urityfocus.com
Subject: Re: XSS vulnerability in phpBB (an other ;-)

In-Reply-To: <19084321117.20030909100957@...l.ru>

>Tuesday, September 9, 2003, 1:43:59 AM, you wrote:
>
>kyf> Hello, i've just found a new xss vulnerability in
phpBB 2.0.6 (i'm not
>kyf> sure but i don't think that others versions are
vulnerable).
>kyf> This vulnerability is located in the [url][/url]
bbcode.
>kyf> You can insert javascript by doing a thing like that:
>kyf> [url=www.google.fr" onclick=alert('Hello')]text[/url]
>
> Think, my phpBB 2.0.5 is not vulnerable.
> I posted "[url=www.google.fr"
onclick=alert('Hello')]text[/url]" into
> the body of the post. No URL link appeared, but I saw
the whole
> string "[url=www.google.fr"
onclick=alert('Hello')]text[/url]" in my
> post.
>
> Was I wrong? Where do we need to place that string?

All 2.0.x are vulnerable - that string is missing
a quote before the javascript code, as phpBB will
quote the beginning of the string and the end of it
on it's own (so your quote at the end should not be
there either).

Although browsers will ignore onclick for A, they won't
ignore onblur and so on. So yes, it's vulnerable.
The fix is somewhat simple though, I don't see why
the phpBB folks are taking so long, this is a critical
bug.

--
Omer Efraim