full-disclosure - Basic Forum by JM LLC - Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAJioCHh7+5-H-6gu3NS3zfSQWMGPXjqzqG=axFnnOXtTcapjzg@mail.gmail.com>
Date: Wed, 24 Jul 2013 18:49:50 +0200
From: Sp3ctrecore  <sp3ctrecore@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Basic Forum by JM LLC - Multiple Vulnerabilities

Dear all,
I have discovered some vulnerabilities in Basic Forum, developed by JM LLC.

Cheers,
Sp3ctrecore

########## ADVISORY ##########

================================================
Basic Forum by JM LLC - Multiple Vulnerabilities
================================================

Software................: Basic Forum
Software link...........: http://www.jmagness.com/download/Basic_Forum.zip
Vendor..................: JM LLC
Vendor homepage.........: http://www.jmagness.com

Exploit author..........: Sp3ctrecore
Contact.................: sp3ctrecore[at]gmail[dot]com

--------
OVERVIEW
--------

Basic Forum is affected by multiple vulnerabilities.

-------------------
DISCLOSURE TIMELINE
-------------------

04/07/2013 -- Multiple vulnerabilities discovered and reported to the vendor.
19/07/2013 -- The vendor confirmed the vulnerabilities, but has no
time to fix them.
24/07/2013 -- Public disclosure.

---------------
VULNERABILITIES
---------------

[01] MULTIPLE SQL INJECTIONS

I.   new.php - title parameter (POST request).
II.  new.php - post parameter (POST request).
III. post.php?id=1 - reply parameter (POST request).

[02] MULTIPLE CROSS-SITE SCRIPTING

I.   user.php - firstname parameter (POST request): stored XSS.
II.  user.php - bio parameter (POST request): stored XSS.
III. new.php - title parameter (POST request): stored XSS.
IV.  new.php - post parameter (POST request): stored XSS.

[03] Cross-site Request Forgery

I.   user.php - firstname parameter (POST request).
II.  user.php - email parameter (POST request).
III. user.php - password parameter (POST request).
IV.  user.php - bio parameter (POST request).
V.   new.php  - title parameter (POST request).
VI.  new.php  - post parameter (POST request).
VII. post.php - reply parameter (POST request).

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/