E107 DoS vulnerability

Type securityvulns
Reporter Securityvulns
Modified 2003-10-30T00:00:00


Program: E107 (www.e107.org) Versions: 0.545 & 0.603 tested, below may also be vulnerable Synopsis: Tagboard Denial of Service vulnerability (system wide) Security Risk: Medium (It's a system wide DoS) Author: Blademaster (nielserman@hotmail.com) (www.hackingheaven.com) URL: http://www.hackingheaven.com/index.php?name=PNphpBB2&file=viewtopic&t=21 Discovered: October 28, 2003 Published: October 29, 2003

Details: E107 is a user friendly postnuke/phpnuke like PHP webpage with many features such as forums, tagboards and user submitted links/downloads/news.

Issue: An attacker can be capable of Denying access to ANY user of a website using E107 with the Chatbox.php (tagboard) module enabled. This due to insufficient filtering of HTML code in the "Name:" editbox on the Chatbox.php script. However, this is not an XSS exploit, since the normal main.php module does not execute this code (instead it rejects loading the whole main.php form)

Exploit: In the Name inputbox of the Chatbox type:

<script = javascript> alert('DoS') <script>

and put anything in the Message inputbox and submit. Reload the page and you will only see:

login/register.php chatbox.php

The rest of the page (any page) will not be loaded. Just this part

Fix: Since I am no good on PHP, I have not been capable of writing a hotfix, however, the system is no longer vulnerable if the Chatbox.php module is DISABLED. Just wait for a fix from e107 itself.

Vendor Status: Not notified, haven't found the time yet to do so. (will be notified in at least 1 day)

sorry for my poor english (dutch guy here :-D)

Beer is liquid bread, It's good for you! Greetz go out to: Legibleskate (testing on his page :-P), MoTT, ROHITAB (for making such a great community), DaunKnown(www.hackingheaven.com) and every other script kiddie on www.rohitab.com.