Bugtraq mailing list archives
Re: XSS vulnerability in phpBB (an other ;-)
From: <omere () hushmail com>
Date: 9 Sep 2003 17:10:06 -0000
In-Reply-To: <19084321117.20030909100957 () mail ru>
Tuesday, September 9, 2003, 1:43:59 AM, you wrote: kyf> Hello, i've just found a new xss vulnerability in
phpBB 2.0.6 (i'm not
kyf> sure but i don't think that others versions are
vulnerable).
kyf> This vulnerability is located in the [url][/url]
bbcode.
kyf> You can insert javascript by doing a thing like that: kyf> [url=www.google.fr" onclick=alert('Hello')]text[/url] Think, my phpBB 2.0.5 is not vulnerable. I posted "[url=www.google.fr"
onclick=alert('Hello')]text[/url]" into
the body of the post. No URL link appeared, but I saw
the whole
string "[url=www.google.fr"
onclick=alert('Hello')]text[/url]" in my
post. Was I wrong? Where do we need to place that string?
All 2.0.x are vulnerable - that string is missing a quote before the javascript code, as phpBB will quote the beginning of the string and the end of it on it's own (so your quote at the end should not be there either). Although browsers will ignore onclick for A, they won't ignore onblur and so on. So yes, it's vulnerable. The fix is somewhat simple though, I don't see why the phpBB folks are taking so long, this is a critical bug. -- Omer Efraim
Current thread:
- XSS vulnerability in phpBB (an other ;-) keupon_ps2 (Sep 08)
- Re: XSS vulnerability in phpBB (an other ;-) Victor Sheldeshov (Sep 09)
- <Possible follow-ups>
- Re: XSS vulnerability in phpBB (an other ;-) John Smith (Sep 09)
- Re: XSS vulnerability in phpBB (an other ;-) Michael Renzmann (Sep 09)
- Re: XSS vulnerability in phpBB (an other ;-) omere (Sep 09)
- Re: XSS vulnerability in phpBB (an other ;-) keupon_ps2 (Sep 09)
- Re: XSS vulnerability in phpBB (an other ;-) Everett Feldt (Sep 10)
- Re: XSS vulnerability in phpBB (an other ;-) Steven M. Christey (Sep 10)