bugtraq - HTML Injection Vuln in nssboard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071014040308.26035.qmail@securityfocus.com>
Date: 14 Oct 2007 04:03:08 -0000
From: kcghost@...il.com
To: bugtraq@...urityfocus.com
Subject: HTML Injection Vuln in nssboard

Nssboard, formerly Simple PHP forum, is vulnerable to HTML injection including scripts (possible XSS) in two ways:
1. If BBcode is disabled, HTML tags are no longer stripped, allowing XSS attacks, etc.

2. Profile information (user, email, Real Name) is not filtered. For example a user could use something like "<script>alert(document.cookie)</script> " as a Real name and the script would execute everytime someone views that users profile or the members page. 

However the number of characters allowed in Real name is limited so it's unlikely too much damage could be done. 

If XSS is allowed, it could allow for Session Hijacking.

I found this bug using version 6.1 of NSSboard (the latest as of this writing), and it's likely that all earlier versions are also affected, but I didn't test them. I am using Debian Linux and lighttpd to host it.

The fix would be to make sure HTML tags are filtered regardless of BBcode being enabled, and to filter user profile input data.

If you are using this software, I would recommend having BBcode enabled even if you don't need it. 

Credit: Me (Casey Fitzpatrick) aka: kcghost, kcblah