NSSBoard 多个跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1188704 漏洞类型 跨站脚本
发布时间 2007-10-15 更新时间 2007-11-15
CVE编号 CVE-2007-5564 CNNVD-ID CNNVD-200710-391
漏洞平台 N/A CVSS评分 2.6
|漏洞来源
https://www.securityfocus.com/bid/26081
https://cxsecurity.com/issue/WLB-2007100067
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200710-391
|漏洞详情
NSSboard(过去称SimplePHPForum)6.1版本中存在多个跨站脚本攻击漏洞。远程攻击者(1)当BBcode被禁用时可以借助HTML标签;或利用(2)user,(3)email,或(4)资料中的RealName字段,注入任意web脚本或HTML。
|漏洞EXP
Nssboard, formerly Simple PHP forum, is vulnerable to HTML injection including scripts (possible XSS) in two ways:

1. If BBcode is disabled, HTML tags are no longer stripped, allowing XSS attacks, etc.

2. Profile information (user, email, Real Name) is not filtered. For example a user could use something like "<script>alert(document.cookie)</script> " as a Real name and the script would execute everytime someone views that users profile or the members page.

However the number of characters allowed in Real name is limited so it's unlikely too much damage could be done.

If XSS is allowed, it could allow for Session Hijacking.

I found this bug using version 6.1 of NSSboard (the latest as of this writing), and it's likely that all earlier versions are also affected, but I didn't test them. I am using Debian Linux and lighttpd to host it.

The fix would be to make sure HTML tags are filtered regardless of BBcode being enabled, and to filter user profile input data.

If you are using this software, I would recommend having BBcode enabled even if you don't need it.

Credit: Me (Casey Fitzpatrick) aka: kcghost, kcblah
|受影响的产品
NSSBoard NSSBoard 0.6.1
|参考资料

来源:XF
名称:nssboard-profile-xss(37218)
链接:http://xforce.iss.net/xforce/xfdb/37218
来源:BID
名称:26081
链接:http://www.securityfocus.com/bid/26081
来源:BUGTRAQ
名称:20071014HTMLInjectionVulninnssboard
链接:http://www.securityfocus.com/archive/1/archive/1/482312/100/0/threaded
来源:SREASON
名称:3246
链接:http://securityreason.com/securityalert/3246