Bugtraq mailing list archives
Invision Power Board : XSS in [FONT] and [COLOR] tags.
From: "Frog Man" <leseulfrog () hotmail com>
Date: Thu, 11 Sep 2003 11:46:10 +0200
Informations : °°°°°°°°°°°°°° Language : PHP Version : 1.2 FINAL Website : http://www.invisionboard.com/ Problem : Permanent XSS Dev : °°°°° [FONT=expression(alert(document.cookie))]text[/FONT] will made the HTML : <span style='font-family:expression(alert(document.cookie))'>text</span> [COLOR=expression(alert(document.cookie))]texte[/COLOR] will made the HTML : <span style='color:expression(alert(document.cookie))'>text</span> and the javascript alert(document.cookie) will be executed. Solution : °°°°°°°°° A patch can be found on http://www.phpsecure.info. In sources/lib/post_parser.php , just replace the lines : ----------------------------------------------------------------------------------------------------------------------------- while ( preg_match( "#\[font=([^\]]+)\](.*?)\[/font\]#ies", $txt ) ) {$txt = preg_replace( "#\[font=([^\]]+)\](.*?)\[/font\]#ies" , "\$this->regex_font_attr(array('s'=>'font','1'=>'\\1','2'=>'\\2'))", $txt );
} while( preg_match( "#\[color=([^\]]+)\](.+?)\[/color\]#ies", $txt ) ) {$txt = preg_replace( "#\[color=([^\]]+)\](.+?)\[/color\]#ies" , "\$this->regex_font_attr(array('s'=>'col' ,'1'=>'\\1','2'=>'\\2'))", $txt );
} ----------------------------------------------------------------------------------------------------------------------------- by the lines : -----------------------------------------------------------------------------------------------------------------------------while ( preg_match( "#\[font=([^;<>\*\(\)\]\"']*)\](.*?)\[/font\]#ies", $txt ) )
{$txt = preg_replace( "#\[font=([^;<>\*\(\)\"']*)\](.*?)\[/font\]#ies" , "\$this->regex_font_attr(array('s'=>'font','1'=>'\\1','2'=>'\\2'))", $txt );
} while( preg_match( "#\[color=([a-zA-Z0-9]*)\](.+?)\[/color\]#ies", $txt ) ) {$txt = preg_replace( "#\[color=([a-zA-Z0-9]*)\](.+?)\[/color\]#ies" , "\$this->regex_font_attr(array('s'=>'col' ,'1'=>'\\1','2'=>'\\2'))", $txt );
} ----------------------------------------------------------------------------------------------------------------------------- More Details : °°°°°°°°°°°° in french : http://www.phpsecure.info/v2/tutos/InvisionPowerBoard1.2F.txt frog-m@n (http://www.phpsecure.info) _________________________________________________________________ Hotmail: votre e-mail gratuit ! http://www.fr.msn.be/hotmail
Current thread:
- Invision Power Board : XSS in [FONT] and [COLOR] tags. Frog Man (Sep 11)