[][][][][][][][][][][][][][][][][][][][][][][][][][] [][][] [] [] HRG - Hackerlounge Research Group [] Release: HRG005 [] Monday 03/01/05 [] Forumwa_v1 [] [] The author can't be held responsible for any damage [] done by a reader. You have your own resonsibility [] Please use this document like it's meant to. [] [][][][][][][][][][][][][][][][][][][][][][][][][][] [][][] Vulnerable: Forumwa_v1 (any version) --- General information: Forumwa is a simple discussion forum, based on PHP and MYSQL. Beside the basic-features there are special functions like search function, user profiles, memberlist, mailer, feedback? Multilanguage, easy installation. --- Description: The search.php script is vulnerable to a XSS attack by a remote attacker. The searched string is not filtered for any harmfull characters like < > and ". This makes it possible for an attacker to trick a user into going to a harmfull page and stealing a session. Also, the body and the subject of a message posted on the forum are not checked for < or > characters. The combination of these two vulnerabilitys makes a real big problem. --- Proof Of Concept: What this proof of concept will do is load a 1x1px IFrame from a message in the board that will abuse the search.php xss attack to change a viewers password to "wh00ters". How to use: make a post containing the following body and hope someone actually views the messages on the board. Once they open the link to view the post, their account is yours. Tip, make it a nice thread that people will reply to so you know who you compromised. ---PoC Injection--- ---PoC Injection--- All that needs to be altered in this injection are the things between [ ] that says "CHANGEME!!!" --- Fix and Vendor status: Vendor has been notified; expect an official patch soon. --- Greetz: All the people at hackerlounge.com, JWT, TGS-Security.com and JWT-Security.net. Specifically: Th3_R@v3n (me), Dlab, Riddick, Enjoi, Blademaster, Modzilla, Pingu, Jake Johnson, Afterburn, airo, cardiaC, chis, ComputerGeek, deep_phreeze, dudley, evasion, eXtacy, Mattewan, Afterburn, Thanatos_Starfire, Roz, Sirross, UmInAsHoE, Infinite, Slarty, NoUse, Snake (I hate you), Surreal (I hate you), -=Vanguard=-, The_IRS, puNKiey, driedice, Carnuss, oKiDaN, Mr.Mind, dementis, net-RIDER, voteforpedro, Cryptic_Override, kodaxx, ~CreEpy~NoDquE~, Brainscan, the_exode, phillysteak12345, DerrtyJake, =>HeX<=, m0rk, and anyone else I forgot. --- Credit: HRG - Hackerlounge Research Group http://www.Hackerlounge.com [][][][][][][][][][][][][][][][][][][][][][][][][][] [][][] [] [] HRG - Hackerlounge Research Group [] Release: HRG005 [] Monday 03/01/05 [] Forumwa_v1 [] [] The author can't be held responsible for any damage [] done by a reader. You have your own resonsibility [] Please use this document like it's meant to. [] [][][][][][][][][][][][][][][][][][][][][][][][][][] [][][]