bugtraq - Re: Phorum 5.1.14 XSS SQL injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 16 Jul 2006 21:59:36 +0200
From: Maurice Makaay <maurice.makaay@...ernl.net>
To: securityconnection@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Phorum 5.1.14 XSS SQL injection Vulnerability

About the Phorum security issues as reported by Ellipsis:

> --------------------------
> Cross Site Scripting (XSS)
> --------------------------
> POST http://target.xx:80/posting.php HTTP/1.0
> Accept: */*
> Content-Type: application/x-www-form-urlencoded
> Host: target.xx
> Content-Length: 447
> message_id=0&forum_id=1&mode=<script>alert(/EllipsisSecurityTest/)</script>

This problem was already detected and fixed by ourselves in the recently 
released Phorum 5.1.15.

> -------------
> SQL injection
> -------------
> http://target.xx/search.php?1,search=1,page='[SQL]

This is *not* an SQL injection vulnerability. On wrong input for page, 
the internally used value of page would become -1, which was then used 
in a limit clause. This would in turn cause an SQL statement error.
There is no way in which this could be exploited for arbitrary SQL 
injection. Ellipsis probably did not check the code here, but decided 
they found an SQL injection vulnerability based on an SQL error that was 
returned by automatic vulnerability checking.

This problem was fixed in Phorum 5.1.15 as well.

With kind regards,

Maurice Makaay
Phorum.org developer