SecurityFocus reveals viewprofile hack

[groundmotion]

http://www.securityfocus.com/archive/1/396744

- Explotation
---------------------------------------------------------
-==Bad Filter of HTML Code==-
phpBB2/profile.php?mode=viewprofile&u=\[]phpBB2/viewtopic.php?p=3&highlight=\[]#########################################################
-==XSS==-
POST /admin/admin_forums.php?sid=7bd54a5a9861ef180af78897e70 HTTP/1.1
forumname=<script>alert('NST')</script>&forumdesc=<script>alert('NST')</script>&c=1&forumstatus=0&prune_days=7&prune_freq=1&mode=createforum&f=&submit=Create
new
forum

Some people cannot find it interest someones yes but well i dont care because if you
put some effort you know that
you can do a lot with this, like fooling the Admin of the Hosting to get his cookie
& and then get access to whm...

http://www.securityfocus.com/bid/13344/exploit/

phpBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

No exploit is required.

The following proof of concept URI is available:
http://www.example.com/phpBB2/profile.p ... profile&u=\[]\

Versions up to - and including - 2.0.14 seem to be vulnerable. Me and my colleague at work just tried it out and we got a big chunk of code and some database entries as a result... feels like something very close to the highlight bug - maybe you already know about this, otherwise please look into it as soon as possible.

Cheers!
- Janne

[Bobble]

*ahem*

phpBB Support
Get help with installation and running phpBB 2.0.x here. Please do not post bug reports, feature requests or MOD-related questions here.

You can be sure that they know about this and a patch will be released when ready.

[groundmotion]

Oops, sorry, too quick on the trigger.

Wasn't sure if this was a bug report or of general interest, but I can see your point.
I will look more into the forum structure in the future.

EDIT: Had a look around now and I'm still not sure where bug reports go.
Only that they are not wanted in any of the PHPBB forums...

[AnthraX101]

This is not a cross site scripting vulnerability, it is misclassified on SF. It is really a path exposure vulnerability. The phpBB team has previously stated that these are not critical enough to warrant a patch.

The XSS vulnerability is separate, and exists within the admin functions. (Note that I have not confirmed this flaw, only heard of it)

AnthraX101

[Graham]

This is not a cross site scripting vulnerability, it is misclassified on SF. It is really a path exposure vulnerability. The phpBB team has previously stated that these are not critical enough to warrant a patch.

Indeed, someone over there needs to remember that a bug - which that admittedly is - does not mean that there is automatically a vulnerability. There do seem to be some people who automatically scream about security over relativel minor bugs. It is certainly something that is likely to be addressed in the next release, but on it's own it's not anything that would justify a new release.

The XSS vulnerability is separate, and exists within the admin functions. (Note that I have not confirmed this flaw, only heard of it)

Personally, I'd question whether that is even an issue. Forum descriptions have always allowed HTML right from the first 2.0.x versions and the only way to alter the description is via POST - it can't be done via GET so it's pretty difficult to spoof someone into doing it (which is what the reporter seems to suggest).

I'd also like to make the point that if people think there is a secuity issue they should report it to our security tracker so that it can be looked at and not post it on BugTraq where people start paniccing not understanding the issue.

[AnthraX101]

[...]

Indeed, someone over there needs to remember that a bug - which that admittedly is - does not mean that there is automatically a vulnerability. There do seem to be some people who automatically scream about security over relativel minor bugs. It is certainly something that is likely to be addressed in the next release, but on it's own it's not anything that would justify a new release.

Just a note that this is a vulnerability, just not a critical one. Many real SQL injection holes are simply looking for a good DB to attack. With MySQL, it is not possible most of the time to run a "show databases", so that something that reveals a real DB name may lead to a successful attack. This is not going to weaken an already secure system, but may be the falling point for a system which has security flaws already.

AnthraX101