bugtraq - [KAPDA::#53] MYBB XSS and Dir Traversal in usercp.php

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060729064146.26866.qmail@securityfocus.com>
Date: 29 Jul 2006 06:41:46 -0000
From: roozbeh_afrasiabi@...oo.com
To: bugtraq@...urityfocus.com
Subject: [KAPDA::#53] MYBB XSS and Dir Traversal in usercp.php


Vulnerable products : MYBB 1.x
Vendor: http://www.mybboard.net
Risk: Low
Vulnerabilities: MYBB XSS and Dir Traversal in usercp.php 

Date :
--------------------
Found : Feb 22 2006
Vendor Contacted : N/A
Release Date : N/A

About :
--------------------
MyBB is a powerful, efficient and free forum package developed in PHP and MySQL.MyBB has been designed with the end users in mind, you and your subscribers. Full control over your discussion system is p resented right at the tip of your fingers, from multiple styles and themes to the ultimate customisation of your forums using the template system.



Vulnerability:
--------------------
Cross_Site_Scripting (XSS,CSS):

MYBB is affected by a cross-site scripting vulnerability. This issue is due to the failure of the application to properly sanitize user-
supplied input.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed
in the browser of an unsuspecting user when followed.


Detail and PoC :
--------------------

Cross_Site_Scripting:

The application does not validate the "gallery" variable upon submission to the usercp.php script. 

POC:
/usercp.php?action=avatar&gallery=%22%3E%3Cscript%3Ealert(1)%3C/script%3E



Dir Traversal For images:

POC:
/usercp.php?action=avatar&gallery=../../uploads
usercp.php?action=do_avatar&gallery=../../../../../../..dir&avatar=myfile

Solution :
--------------------
N/A

Credit :
--------------------
Discoverd by : Roozbeh Afrasiabi
roozbeh_afrasiabi[at]yahoo[dot]com
black_death[at]kapda[dot]net

POC by : imei addmimistrator
addmimistrator[at]gmail[dot]com
imei[at]Kapda[dot]net


--------------------