exploits , vulnerabilities , articles , Simple Machines Forum Size Tag HTML Injection Vulnerability

Title	Simple Machines Forum Size Tag HTML Injection Vulnerability
Published	2004-05-05-12:00AM
Updated	2004-05-05-07:52PM
Class	Input Validation Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	This vulnerability is credited to Cheng Peng Su <apple_soup@msn.com>.
Vulnerable	Simple Machines SMF 1.0 beta5p Simple Machines SMF 1.0 beta4p Simple Machines SMF 1.0 beta4.1
Not Vulnerable
Code	No exploit is required for this issue, however Cheng Peng Su <apple_soup@msn.com> provided some proof-of-concept code. An attacker could reportedly post content to the forums containing: [size=expression(alert(document.cookie))]Content[/size] With the limit that the forum software filters out quotes, apostrophes and semicolons. Another method that circumvents the software filtering would be to post content such as: [size=expression(eval(unescape(document.URL.substring(document.URL.length-34,document.URL.length))))]Content[/size] then get the victim to follow: http://www.example.com/index.php?topic=12345.0&alert('cookie: '+document.cookie) Where the '12345.0' is the topic containing the previously posted content. The victim's browser would execute the last 34 characters (as specified in the previously posted 'length-34' content).
TXT

Vulnerabilities - newest 10 RSS | More

• 2009-12-17 Digital Scribe Cross Site Scripting and SQL Injection Vulnerabilities
• 2009-12-17 WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
• 2009-12-17 Quick Heal AntiVirus Insecure Program File Permissions Local Privilege Escalation Vulnerability
• 2009-12-17 IntelliCom NetBiter webSCADA Multiple Default Password Security Bypass Vulnerabilities
• 2009-12-17 Webmatic Multiple Unspecified SQL Injection and Cross-Site Scripting Vulnerabilities
• 2009-12-17 ManageEngine Password Manager Pro Cross Site Scripting Vulnerability
• 2009-12-17 HP OpenView Storage Data Protector Multiple Remote Code Execution Vulnerabilities
• 2009-12-17 iDevSpot iSupport Multiple Cross Site Scripting Vulnerabilities
• 2009-12-17 GNU Automake Insecure Directory Permissions Vulnerability
• 2009-12-17 Mozilla Firefox CVE-2009-3979 Multiple Remote Memory Corruption Vulnerabilities

• Vulnerabilities
• Exploits
• News
• Articles

Copyright 2007, SecurityDot
Fri, 18 Dec 2009 00:25:37 +0000