Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Phorum 5.1.14 XSS SQL injection Vulnerability
From: Maurice Makaay <maurice.makaay () internl net>
Date: Sun, 16 Jul 2006 21:59:36 +0200

About the Phorum security issues as reported by Ellipsis:

--------------------------
Cross Site Scripting (XSS)
--------------------------
POST http://target.xx:80/posting.php HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Host: target.xx
Content-Length: 447
message_id=0&forum_id=1&mode=<script>alert(/EllipsisSecurityTest/)</script>

This problem was already detected and fixed by ourselves in the recently released Phorum 5.1.15.

-------------
SQL injection
-------------
http://target.xx/search.php?1,search=1,page='[SQL]

This is *not* an SQL injection vulnerability. On wrong input for page, the internally used value of page would become -1, which was then used in a limit clause. This would in turn cause an SQL statement error. There is no way in which this could be exploited for arbitrary SQL injection. Ellipsis probably did not check the code here, but decided they found an SQL injection vulnerability based on an SQL error that was returned by automatic vulnerability checking.

This problem was fixed in Phorum 5.1.15 as well.


With kind regards,

Maurice Makaay
Phorum.org developer


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]