bugtraq - E107 DoS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <HJEPIAOIOCPADKHMGDOJAEABCAAA.blademaster@msbx.net>
Date: Wed, 29 Oct 2003 23:12:29 +0100
From: "Blademaster" <blademaster@...x.net>
To: <bugtraq@...urityfocus.com>
Subject: E107 DoS vulnerability

Program: E107 (www.e107.org)
Versions: 0.545 & 0.603 tested, below may also be vulnerable
Synopsis: Tagboard Denial of Service vulnerability (system wide)
Security Risk: Medium (It's a system wide DoS)
Author: Blademaster (nielserman@...mail.com) (www.hackingheaven.com)
URL:
http://www.hackingheaven.com/index.php?name=PNphpBB2&file=viewtopic&t=21
Discovered: October 28, 2003
Published: October 29, 2003

Details:
E107 is a user friendly postnuke/phpnuke like PHP webpage with many features
such as forums, tagboards and user submitted links/downloads/news.

Issue:
An attacker can be capable of  Denying access to ANY user of a website using
E107 with the Chatbox.php (tagboard) module enabled. This due to
insufficient filtering of HTML code in the "Name:" editbox on the
Chatbox.php script. However, this is not an XSS exploit, since the normal
main.php module does not execute this code (instead it rejects loading the
whole main.php form)

Exploit:
In the Name inputbox of the Chatbox type:

<script = javascript> alert('DoS') <script>

and put anything in the Message inputbox and submit. Reload the page and you
will only see:

login/register.php
chatbox.php

The rest of the page (any page) will not be loaded. Just this part

Fix:
Since I am no good on PHP, I have not been capable of writing a hotfix,
however, the system is no longer vulnerable if the Chatbox.php module is
DISABLED.
Just wait for a fix from e107 itself.

Vendor Status:
Not notified, haven't found the time yet to do so. (will be notified in at
least 1 day)

sorry for my poor english (dutch guy here :-D)
------

Beer is liquid bread, It's good for you!
Greetz go out to: Legibleskate (testing on his page :-P), MoTT, ROHITAB (for
making such a great community), DaunKnown(www.hackingheaven.com) and every
other script kiddie on www.rohitab.com.

WWW.HACKINGHEAVEN.COM