Waraxe IT Security Portal
Login or Register
December 13, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 44
Members: 0
Total: 44
Full disclosure
APPLE-SA-12-11-2024-9 Safari 18.2
APPLE-SA-12-11-2024-8 visionOS 2.2
APPLE-SA-12-11-2024-7 tvOS 18.2
APPLE-SA-12-11-2024-6 watchOS 11.2
APPLE-SA-12-11-2024-5 macOS Ventura 13.7.2
APPLE-SA-12-11-2024-4 macOS Sonoma 14.7.2
APPLE-SA-12-11-2024-3 macOS Sequoia 15.2
APPLE-SA-12-11-2024-2 iPadOS 17.7.3
APPLE-SA-12-11-2024-1 iOS 18.2 and iPadOS 18.2
SEC Consult SA-20241211-0 :: Reflected Cross-Site Scripting in Numerix License Server Administration System Login
St. Poelten UAS | Multiple Vulnerabilities in ORing IAP
SEC Consult SA-20241204-0 :: Multiple Critical Vulnerabilities in Image Access Scan2Net (14 CVE)
Microsoft Warbird and PMP security research - technical doc
Access Control in Paxton Net2 software
SEC Consult SA-20241127-0 :: Stored Cross-Site Scripting in Omada Identity (CVE-2024-52951)
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> Newbies corner -> woltlab burning board multiple remote vulnerabilities
Post new topicReply to topic View previous topic :: View next topic
woltlab burning board multiple remote vulnerabilities
PostPosted: Sat Jun 20, 2009 12:57 pm Reply with quote
markus0815
Beginner
Beginner
Joined: May 28, 2009
Posts: 3




i'm posting this straight from milw0rm and will comment it a little:


# Vulnerabilities: BBCode IMG / XSS / Delete PM / Full Path Disclosure / URL Redirection

// so far so good


# BBCode IMG Tag Script Injection
# [img]http://[host][/img]


// what exactly will this do? i can enter the URL to a server of mine which i could place a script at, right?


# Cross Site Scripting

# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.


// what exactly will this do?


# URL Redirection

# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]


// what are the possibilities here? especially in the first one, what's dereferrer.php and what does it do? the second one, erm, how would this work? action=delete will only work with admin privileges afaik?


# Full Path Discloscure

# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.


// again, full explanation needed Smile


thanks
View user's profile Send private message
PostPosted: Sat Jun 20, 2009 6:44 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




1. BBCode IMG Tag Script Injection --> I fail to see any script injection here.
There is some example:

# Delete Private Messages (BBCode IMG Tag Script Injection)

# Insert into a (forum message/private message/your signature) the code below:
# [img]http://[host]/[path]/wbb/index.php?page=PM&action=delete&pmID=[ID]&folderID=0[/img]
# The fake image doesn't show errors.

It's actually CSRF vulnerability and is not related to BBCode at all.

2. # Cross Site Scripting

# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.

XSS can be useful, if software is using cookie-based session management and if sessions are not locked to IP-address. Anyway, Reflected XSS needs social engineering: you must somehow get your victim to visit the website under your control.

3. # URL Redirection

# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]

This is useless vulnerability. It can mean HTTP Response Splitting possibilities or it can be used by spammers for concealing the source though.

4. # Full Path Discloscure

# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.

Full path disclosure is useful as additional information source and it can help exploiting other vulnerabilities. It's just one piece of puzzle Smile

So by my opinion there is no vulnerabilities here, which can take inside of target server. Sql Injections, LFI, RFI, RCE - this kind of vulnerabilities are more valuable Smile
View user's profile Send private message Send e-mail Visit poster's website
woltlab burning board multiple remote vulnerabilities
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB © 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.048 Seconds