Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Board-TNK Cross Site Scripting

Board-TNK Cross Site Scripting

by Nikola Strahija on March 18th, 2002 Board-TNK is a discussion board written in PHP (versions for both PHP3 and PHP4 are available). It has support for multiple forums, use of cookies for showing users new messages since their last visit and storing their information to simplify new posts, a choice of smiley icons for each message, ability to use a subset of HTML within the messages, multiple language support.


And a full admin page that allows you to
create and delete forums, entire threads, or answers
from a thread. It is possible to prefix the MySQL
tables if only one database is allowed on an ISP
server.

A Cross Site Scripting vulnerability exists in
Board-TNK forums. This would allow a remote
attacker to send information to victims from untrusted
web servers, and make it look as if the information
came from the legitimate server.


Details
-------
The URL's and the user input seem to be filtered
pretty good. But I guess that the coders have missed
a point. The "WEB" input when replying or creating
topics, is not filtered enough. So a Cross Site
Scripting vulnerability exists in Board-TNK forums.


Example input for the "WEB" input
<script>alert("ALPERz was here!")</script>

After submitting this information, whenever anyone
browses the page where the topic is, the script will
take effect.


Solution
--------
The vendor replied to my mail and released a new
version which is immune to this vulnerability very
quickly (on the same day :})

You may download the new version or use the
method suggested by me, and approved by the
vendor, if you have made any modifications to the
board.

Strip HTML tags, and possibly other malicious code
within "xx_board.php". Where xx is the specified
forum language (Eg: en for English). Default for that
is "board.php".

I suggest the following as a workaround;
At the beginning of "board.php" add the lines below;

# Patch Start
$web_post= strip_tags ($web_post);
# Patch End


Credits
-------
Discovered on 15, March, 2002 by
Ahmet Sabri ALPER
[email protected]
http://www.olympos.org


References
----------
Product Web Page: http://www.linux-sottises.net/


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »