From gregory.lebras@security-corp.org Sat Feb 22 23:06:22 2003 From: "[iso-8859-1] Grégory Le Bras | Security Corporation" To: full-disclosure@lists.netsys.com Date: Sun, 23 Feb 2003 03:28:40 +0100 Subject: [Full-Disclosure] [SCSA-007] Cross Site Scripting Vulnerabilities in WWWBoard [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ________________________________________________________________________ Security Corporation Security Advisory [SCSA-007] ________________________________________________________________________ PROGRAM: WWWBoard HOMEPAGE: http://www.scriptarchive.com VULNERABLE VERSIONS: 2.0A2.1 and prior ________________________________________________________________________ DESCRIPTION ________________________________________________________________________ WWWBoard is "A threaded discussion forum that allows users to post new messages, followup to existing ones and more. Includes a basic admin to maintain the board." (direct quote from WWWBoard website) DETAILS ________________________________________________________________________ A Cross-Site Scripting vulnerability have been found in WWWBoard which allow attackers to inject script codes into the forum and use them on clients browser as if they were provided by the site. This Cross-Site Scripting vulnerability are found in the page for posting messages. An attacker can input specially crafted links and/or other malicious scripts. EXPLOIT ________________________________________________________________________ A vulnerability was discovered in the page for posting messages, at this adress : http://[target]/wwwboard/wwwboard.html#post The vulnerability is at the level of the interpretation of the "Message" field. Indeed, the insertion of a hostile code script in this field makes it possible to a malicious user to carry out this script on the navigator of the visitors. The hostile code could be : [script]alert("Cookie="+document.cookie)[/script] (open a window with the cookie of the visitor.) (replace [] by <>) SOLUTIONS ________________________________________________________________________ No solution for the moment. VENDOR STATUS ________________________________________________________________________ The vendor has reportedly been notified. LINKS ________________________________________________________________________ http://www.security-corp.org/index.php?ink=4-15-1 Version Française : http://www.security-corp.org/advisories/SCSA-007-FR.txt ------------------------------------------------------------ Grégory Le Bras aka GaLiaRePt | http://www.Security-Corp.org ------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html