|
|
|
|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 44
Members: 0
Total: 44
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
woltlab burning board multiple remote vulnerabilities |
|
Posted: Sat Jun 20, 2009 12:57 pm |
|
|
markus0815 |
Beginner |
|
|
Joined: May 28, 2009 |
Posts: 3 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Posted: Sat Jun 20, 2009 6:44 pm |
|
|
waraxe |
Site admin |
|
|
Joined: May 11, 2004 |
Posts: 2407 |
Location: Estonia, Tartu |
|
|
|
|
|
|
1. BBCode IMG Tag Script Injection --> I fail to see any script injection here.
There is some example:
# Delete Private Messages (BBCode IMG Tag Script Injection)
# Insert into a (forum message/private message/your signature) the code below:
# [img]http://[host]/[path]/wbb/index.php?page=PM&action=delete&pmID=[ID]&folderID=0[/img]
# The fake image doesn't show errors.
It's actually CSRF vulnerability and is not related to BBCode at all.
2. # Cross Site Scripting
# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.
XSS can be useful, if software is using cookie-based session management and if sessions are not locked to IP-address. Anyway, Reflected XSS needs social engineering: you must somehow get your victim to visit the website under your control.
3. # URL Redirection
# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]
This is useless vulnerability. It can mean HTTP Response Splitting possibilities or it can be used by spammers for concealing the source though.
4. # Full Path Discloscure
# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.
Full path disclosure is useful as additional information source and it can help exploiting other vulnerabilities. It's just one piece of puzzle
So by my opinion there is no vulnerabilities here, which can take inside of target server. Sql Injections, LFI, RFI, RCE - this kind of vulnerabilities are more valuable |
|
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|