Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » [SCSA-007] Cross Site Scripting Vulnerabilities in WWWBoard

[SCSA-007] Cross Site Scripting Vulnerabilities in WWWBoard

by Nikola Strahija on February 23rd, 2003 A Cross-Site Scripting vulnerability have been found in WWWBoard which allow attackers to inject script codes into the forum and use them on clients browser as if they were provided by the site.


Security Corporation Security Advisory [SCSA-007]


PROGRAM: WWWBoard
HOMEPAGE: http://www.scriptarchive.com
VULNERABLE VERSIONS: 2.0A2.1 and prior


DESCRIPTION


WWWBoard is "A threaded discussion forum that allows users to post
new messages, followup to existing ones and more. Includes a basic
admin to maintain the board."

(direct quote from WWWBoard website)


DETAILS


A Cross-Site Scripting vulnerability have been found in WWWBoard
which allow attackers to inject script codes into the forum and use them
on clients browser as if they were provided by the site.

This Cross-Site Scripting vulnerability are found in the page for
posting messages.

An attacker can input specially crafted links and/or other
malicious scripts.


EXPLOIT


A vulnerability was discovered in the page for posting messages,
at this adress :

http://[target]/wwwboard/wwwboard.html#post


The vulnerability is at the level of the interpretation of the "Message"
field.

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator
of the visitors.


The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)


SOLUTIONS


No solution for the moment.


VENDOR STATUS


The vendor has reportedly been notified.


LINKS

http://www.security-corp.org/index.php?ink=4-15-1

Version Française :

http://www.security-corp.org/advisories/SCSA-007-FR.txt


------------------------------------------------------------
Grégory Le Bras aka GaLiaRePt | http://www.Security-Corp.org
------------------------------------------------------------


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »