woltlabXSS.txt

`  
  
Advisory Information  
--------------------  
Advisory name : Woltlab Burning Board Lite formmail.php XSS  
Discovered by : drhankey / it-security23.net  
Vendor Name : Woltlab  
Vendor Homepage : http://www.woltlab.de  
Software : Woltlab Burning Board Lite  
Vulnerability Type : Cross-Site-Scripting  
Vulnerable Versions : 1.0.0, 1.0.1e, maybe more  
Platforms : OS Independent, PHP  
  
  
What is Woltlab Burning Board Lite?  
----------------------------------  
Woltlab Burning Board Lite is the free version of the Woltlab Burning Board,  
a PHP based bulletin board  
  
  
Vulnerability Description:  
-------------------------  
formmail.php outputs the "userid"-parameter unfiltered, so its possible to add arbitary Code to the output by using a malformed link.  
The Board also allows logging in with stolen cookies.  
  
Proof of Concept:  
-----------------  
http://website/board/formmail.php?userid=1"><script>document.location.href="http://www.it-security23.net";</script x="y  
`