bugtraq - Multiple vulnerabilities in Topic Calendar 1.0.1 for phpBB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <001601c53006$6f134cc0$0201a8c0@alberto>
Date: Thu, 24 Mar 2005 01:14:23 +0100
From: "Alberto Trivero" <trivero@...py.it>
To: <bugtraq@...urityfocus.com>
Subject: Multiple vulnerabilities in Topic Calendar 1.0.1 for phpBB


*********************************************************************
* CODEBUG Labs
* Advisory #8
* Title: Multiple vulnerabilities in Topic Calendar 1.0.1 for phpBB
* Author: Alberto Trivero
* English Version: Alberto Trivero
* Product: Topic Calendar 1.0.1
* Type: Multiple Vulnerabilities
* Web: http://www.codebug.org/
*********************************************************************


--) Software Page (www.phpbb.com/phpBB/viewtopic.php?t=150857)

Topic Calendar is a quite widespread MOD for phpBB all version that will add
a calendar
to the board, using topics as event. The authorizations are managed at
forums, groups
and users level, as the standard phpBB auths.


--) Full Path Disclosure

If phpBB is running on a Microsoft IIS Server, it's possible to obtain the
full path by
sending simples requests like these:

   http://www.example.com/phpbb/calendar_scheduler.php%5C
   http://www.example.com/phpbb/calendar_scheduler.php?d=-1

Note that these requests doesn't works under the others webservers like
Apache.


--) Cross-Site Scripting (XSS)

Let's look at code from calendar_scheduler.php at line 82:

   <?
   ...
   if ( isset($HTTP_POST_VARS['start']) || isset($HTTP_GET_VARS['start']) )
   {
     $start = isset($HTTP_POST_VARS['start']) ? $HTTP_POST_VARS['start'] :
$HTTP_GET_VARS['start'];
   }
   ...
   ?>

and at line 375:

   <?
   ...
   $s_hidden_fields .= '<input type="hidden" name="start" value="' . $start
. '" />';
   ...
   ?>

$start is a variable that can be controlled by a remote user, and, as we can
see, there
isn't any control on she, so anyone con inject some HTML code like:

   "><script>alert(document.cookie)</script>

that will change the HTML line in:

   <input type="hidden" name="start"
value=""><script>alert(document.cookie)</script>" />

executing the <script>...</script> tag that show, in this case, the cookies.
This is the complete URL:


http://www.example.com/phpbb/calendar_scheduler.php?start=%22%3E%3Cscript%3E
alert(document.cookie)%3C/script%3E


--) Patch

To fix the XSS bug we can use the function intval() at line 85 of
calendar_scheduler.php:

   <?
   ...
   if ( isset($HTTP_POST_VARS['start']) || isset($HTTP_GET_VARS['start']) )
   {
     $start = isset($HTTP_POST_VARS['start']) ? $HTTP_POST_VARS['start'] :
$HTTP_GET_VARS['start'];
     $start = intval($start)
   }
   ...
   ?>



*********************************************************************
        http://www.codebug.org/
*********************************************************************