full-disclosure - Unpatched phpBB XSS [in 2.0.16]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed Jul  6 14:27:32 2005
From: mail at code-foundation.de (Dominik Birk)
Subject: Unpatched phpBB XSS [in 2.0.16]

> PoC is included with the description. I would advise administrators to
> disable the rendering of BBCode for the time being, this mitigates the
> issue.

According to this Exploit there is still no official answer from PHPBB.
Because of that, I just want to post my personal little version of
bugfixing this problem, with which you can obviate attacks on Users who
use IE, but you will loose the functionality of [url]-Tags.

#
#-----[ OPEN ]------------------------------------------
#
/templates/$template/bbcode.tpl

#
#-----[ FIND ]------------------------------------------
#
<!-- BEGIN url --><a href="{URL}" target="_blank"
class="postlink">{DESCRIPTION}</a><!-- END url -->

#
#-----[ SUBSTITUTE ]------------------------------------
#

//<!-- BEGIN url --><a href="{URL}" target="_blank"
class="postlink">{DESCRIPTION}</a><!-- END url -->
<!-- BEGIN url -->Function currently disabled<!-- END url -->

#
#-----[ SAVE FILE ]------------------------------------
#
EOF

I propose to call this steps off after PHPBB has released an official
bugfix.

HTH

Dominik Birk