PunBB 1.2.11 Cross site scripting
/*
---------------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST]® Advisory #22
---------------------------------------------------------------
Program : PunBB 1.2.11
Homepage: http://www.punbb.org
Vulnerable Versions: PunBB 1.2.11 & lower ones
Risk: Low!
Impact: Indirect cross site scripting
-> PunBB 1.2.11 Cross site scripting <-
---------------------------------------------------------------
- Description
---------------------------------------------------------------
In short, PunBB is a fast and lightweight PHP powered discussion board.
It is released under the GNU Public License. Its primary goal is to be
a faster, smaller and less graphic alternative to otherwise excellent
discussion boards such as phpBB, Invision Power Board or vBulletin.
PunBB has fewer features than many other discussion boards, but is
generally faster and outputs smaller pages.
- Tested
---------------------------------------------------------------
Tested in localhost & many forums
- Bug
---------------------------------------------------------------
In this case the XSS it is taken as a low risk bug because of its
circumstances.
An admin in PunBB can use a feature called `Admin note' to keep some
notes about a certain user. The problem is that this note it is not
sanitized.
As you can see, an attack could only been executed if the admin writes
a malicius script, wich is stupid.
This note it is seen on every post of the user, but here its filtered,
the problem lies when the admin look to all users who have a certain IP.
f.e: The admin wants to know all users that have the IP-> 2.0.0.6
The output will be:
Username E-mail Title/Status Posts Admin note Actions
baduser b@xxx New member 500 [blank] .....
So, there the admin note its executed as HTML code (JScript) or whatever.
- Exploit
---------------------------------------------------------------
NST will not release any code to exploit this bug.
- Solutions
---------------------------------------------------------------
A new version of PunBB it is available, it is recommended to update it.
- Timeline
---------------------------------------------------------------
26/03/2006 - Vendor was contacted
Many days - Discussing about the issue explotation.
05/20/2006 - Vendor released a new patched version.
- Discalimer
---------------------------------------------------------------
YOU are the only RESPONSALBE of any DAMAGE of above techniques
could cause or any code you have made based in this advisory,
all ideas, proof of concepts, solutions, descriptions were made
only for EDUCATIONAL propuses, use all above information at your
own risk.
- References
---------------------------------------------------------------
http://NeoSecurityTeam.net/index.php?action=advisories&id=22
http://www.neosecurityteam.net/advisories/Advisory-22.txt
- Credits
--------------------------------------------------------------
Discovered by k4p0 -> k4p0k4p0[at]hotmail[dot]com
[N]eo [S]ecurity [T]eam [NST]® - http://NeoSecurityTeam.net/
Irc.FullNnetwork.org #nst
Questions? (Eng & Spa) -> http://NeoSecurityTeam.net/foro/
- Greets
---------------------------------------------------------------
Paisterist
HaCkZaTaN
Link
Daemon21
erg0t
NST Comunity!
@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@@@@'''''@@@''''
'@@'''@@@@'''''''''@@@''''@@@''''
@@@@''''@@'@@@@@@@@@@''''@@@@@'''
*/