bugtraq - Invision Power Board : XSS in [FONT] and [COLOR] tags.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Law15-F106SfqtKrQNH000477ed@hotmail.com>
Date: Thu, 11 Sep 2003 11:46:10 +0200
From: "Frog Man" <leseulfrog@...mail.com>
To: bugtraq@...urityfocus.com, vulnwatch@...urityfocus.com
Subject: Invision Power Board : XSS in [FONT] and [COLOR] tags.


Informations :
°°°°°°°°°°°°°°
Language : PHP
Version : 1.2 FINAL
Website : http://www.invisionboard.com/
Problem : Permanent XSS

Dev :
°°°°°
[FONT=expression(alert(document.cookie))]text[/FONT] will made the HTML :
<span style='font-family:expression(alert(document.cookie))'>text</span>
[COLOR=expression(alert(document.cookie))]texte[/COLOR] will made the HTML :
<span style='color:expression(alert(document.cookie))'>text</span>

and the javascript alert(document.cookie) will be executed.

Solution :
°°°°°°°°°
A patch can be found on http://www.phpsecure.info.
In sources/lib/post_parser.php , just replace the lines :
-----------------------------------------------------------------------------------------------------------------------------
while ( preg_match( "#\[font=([^\]]+)\](.*?)\[/font\]#ies", $txt ) )
{
	$txt = preg_replace( "#\[font=([^\]]+)\](.*?)\[/font\]#ies"    , 
"\$this->regex_font_attr(array('s'=>'font','1'=>'\\1','2'=>'\\2'))", $txt );
}

while( preg_match( "#\[color=([^\]]+)\](.+?)\[/color\]#ies", $txt ) )
{
	$txt = preg_replace( "#\[color=([^\]]+)\](.+?)\[/color\]#ies"  , 
"\$this->regex_font_attr(array('s'=>'col' ,'1'=>'\\1','2'=>'\\2'))", $txt );
}
-----------------------------------------------------------------------------------------------------------------------------

by the lines :

-----------------------------------------------------------------------------------------------------------------------------
while ( preg_match( "#\[font=([^;<>\*\(\)\]\"']*)\](.*?)\[/font\]#ies", $txt 
) )
{
	$txt = preg_replace( "#\[font=([^;<>\*\(\)\"']*)\](.*?)\[/font\]#ies"    , 
"\$this->regex_font_attr(array('s'=>'font','1'=>'\\1','2'=>'\\2'))", $txt );
}

while( preg_match( "#\[color=([a-zA-Z0-9]*)\](.+?)\[/color\]#ies", $txt ) )
{
	$txt = preg_replace( "#\[color=([a-zA-Z0-9]*)\](.+?)\[/color\]#ies"  , 
"\$this->regex_font_attr(array('s'=>'col' ,'1'=>'\\1','2'=>'\\2'))", $txt );
}
-----------------------------------------------------------------------------------------------------------------------------

More Details :
°°°°°°°°°°°°
in french : http://www.phpsecure.info/v2/tutos/InvisionPowerBoard1.2F.txt







frog-m@n (http://www.phpsecure.info)

_________________________________________________________________
Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail