bugtraq - Re: XSS vulnerability in phpBB (an other ;-)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 9 Sep 2003 18:47:28 -0000
From: <keupon_ps2@...oo.fr>
To: bugtraq@...urityfocus.com
Subject: Re: XSS vulnerability in phpBB (an other ;-)

In-Reply-To: <20030909171006.23428.qmail@...www1-symnsj.securityfocus.com>

Excuse me, i've made a little error in my example.
This will not work:
[url=www.google.fr" onclick="alert('Hello')]text[/url]
but this will work (on phbb 2.0.6):
[url=http://www.google.fr" onclick="alert('Hello')]text[/url]

I don't remeber who has said that it will work on every version of phpBB 
but i've tested it on phpBB 2.0.4 and it doesn't work.
An other person has said that it only works with this code:
[url=http://www.google.fr" onclick="alert('Hello');"]text[/url]
I've tested it on 2.0.6 and it works but the code without the ;" works 
also.

If you make over tests, please, indicate which version of phpBB you are 
using.