Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS
From: Moritz Naumann <oss-security () moritz-naumann com>
Date: Mon, 31 Dec 2012 15:14:26 +0100

On 31.12.2012 11:42 Henri Salo wrote:
[..]
Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this. Please note 
there is several comments[1][2] in forums about this too.

[..]
It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT 
CVE-2012-5903?

Based on the authors' description it would seem more likely that the
attack would use social engineering to trick the legitimate forum admin
into accessing this URL with a payload in it, which would then trigger
in his browser and disclose the admins' session cookie to an attacker by
means of cross site scripting. Like you, I don't see how the value
passed to the "scheduled" parameter would be echoed out, though.

While it doesn't directly impact treatment of this latest report, I'd
like to point out that there has been a previous report by the same
author on the same product back in october, which I was also unable to
reproduce:

From:    irist.ir () gmail com
To:      bugtraq () securityfocus com
Date:    Tue, 23 Oct 2012 19:20:10 GMT
Subject: Smf 2.0.2 Cross-Site Scripting Vulnerability

# Exploit Title : Smf 2.0.2 Cross-Site Scripting Vulnerability
#
# Author        : IrIsT.Ir
#
# Discovered By : Am!r

http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html


Same for a supposed vulnerability in Wordpress which was reported the
day after:

From:    irist.ir () gmail com
To:      bugtraq () securityfocus com
Subject: Wordpress 3.4 Cross-Site Scripting Vulnerability

# Exploit Title : Wordpress 3.4 Cross-Site Scripting Vulnerability
#
# Author        : IrIsT.Ir
#
# Discovered By : Am!r



I contacted the sender address back then, pointing out that:

it's an XSS if the application returns the input in an unencoded way,
allowing an attacker (or victim) to inject script code into the
applications output. I don't see how this is the case with the SMF or
Wordpress code you quoted.

I have not received a reply.

Moritz


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]