vikingboard-xss.txt

`#################################################  
Vikingboard multiple Cross site scripting  
Vendor url: http://vikingboard.com/  
advisore:http://lostmon.blogspot.com/2007/07/  
vikingboard-multiple-cross-site.html  
vendor notify:yes exploit include:yes  
#################################################  
  
  
Vikingboard is a PHP-based community board designed by  
the principle of "less is more", and features a powerful  
web-based extension-system, a lighting-fast cache system  
and dynamic web update. Small, but incredibly fast and powerful.  
  
  
  
Vikingboard contains a flaw that allows a remote cross site  
scripting attack.This flaw exists because the application does  
not validate multiple params upon submission to multiple scripts  
.This could allow a user to create a specially crafted URL that  
would execute arbitrary code in a user's browser within the  
trust relationship between the browser and the server,  
leading to a loss of integrity.  
  
  
  
################  
versions  
################  
  
Vikingboard 0.1.2  
  
  
################  
Solution:  
################  
  
No solution was available at this time !!!  
  
################  
TimeLine  
################  
  
Discovered: 20-07-2007  
vendor notify: 25-07-2007  
vendor response:  
disclosure:25-07-2007  
  
  
#####################  
Examples  
#####################  
  
  
http://localhost/viking/cp.php?mode=9&id=2[XSS-CODE]  
http://localhost/viking/cp.php?mode=7&f=1[XSS-CODE]  
http://localhost/viking/cp.php?mode=6"e=1[XSS-CODE]  
http://localhost/viking/cp.php?mode=12&act=[XSS-CODE]  
  
http://localhost/viking/user.php?u=2[XSS-CODE]  
http://localhost/viking/help.php?act=guidelines[XSS-CODE]  
  
  
we can call the debug parameter to obtain sensitive information.  
  
  
http://localhost/viking/post.php?mode=00&f=1[XSS-CODE]&poll=0  
  
wen send a private message the field "Message Title " is affected  
  
http://localhost/viking/cp.php?mode=6  
  
we can send a PM with a malformed XSS title to others users  
and it is executed wen the vicims go to Inbox on his control panel  
  
http://localhost/viking/cp.php?mode=7&f=1  
  
http://localhost/viking/report.php?p=2[XSS-CODE]  
  
  
http://localhost/viking/topic.php?t=2&s=0[XSS-CODE]  
  
http://localhost/viking/post.php?mode=03&t=2"e=2[XSS-CODE]  
http://localhost/viking/post.php?mode=03&t=2[XSS-CODE]"e=2  
http://localhost/viking/post.php?mode=00&f=1&poll=0[XSS-CODE]  
  
http://localhost/viking/post.php?mode=02&p=2[XSS-CODE]  
  
http://localhost/viking/search.php?search=user:administrator&act=dosearch  
  
if the user has any script code in the first lines of any post  
wen try fo find all post by this user , and wen the applications  
show the results it is executed  
  
##################### €nd ##############################  
  
--  
atentamente:  
Lostmon ([email protected])  
Web-Blog: http://lostmon.blogspot.com/  
Google group: http://groups.google.com/group/lostmon (new)  
`