Bugtraq mailing list archives
Re: www.proboards.com / YaBB XSS Vuln
From: Patrick Clinger <pclinger () proboards com>
Date: 17 Sep 2004 18:07:21 -0000
In-Reply-To: <20040915231242.3251.qmail () www securityfocus com> This flaw has been fixed. I would like to take this opportunity to first state that ProBoards does not run on YaBB software as the author of this thread implies. We run on our own in-house developed software, which the YaBB team will vouch for. Also I would like to note that we were not notified of this vulnerability until last last night, nearly 24 hours after it was posted here. I respectfully request of the author of this post to first contact the vendor as is the standard courtesy for these situations. Not contacting the vendor first is irresponsible. Patrick Clinger ProBoards.com
Received: (qmail 10060 invoked from network); 16 Sep 2004 20:37:50 -0000 Received: from mail2.securityfocus.com (205.206.231.1) by mail.securityfocus.com with SMTP; 16 Sep 2004 20:37:50 -0000 Received: (qmail 18319 invoked by alias); 16 Sep 2004 20:18:24 -0000 Delivered-To: archive-bugtraq () securityfocus com Received: (qmail 18302 invoked from network); 16 Sep 2004 20:18:24 -0000 Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) (205.206.231.26) by mail2.securityfocus.com with SMTP; 16 Sep 2004 20:18:24 -0000 Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20]) by outgoing2.securityfocus.com (Postfix) with QMQP id 37B7E143E09; Thu, 16 Sep 2004 09:24:09 -0600 (MDT) Mailing-List: contact bugtraq-help () securityfocus com; run by ezmlm Precedence: bulk List-Id: <bugtraq.list-id.securityfocus.com> List-Post: <mailto:bugtraq () securityfocus com> List-Help: <mailto:bugtraq-help () securityfocus com> List-Unsubscribe: <mailto:bugtraq-unsubscribe () securityfocus com> List-Subscribe: <mailto:bugtraq-subscribe () securityfocus com> Delivered-To: mailing list bugtraq () securityfocus com Delivered-To: moderator for bugtraq () securityfocus com Received: (qmail 29611 invoked from network); 15 Sep 2004 16:58:21 -0000 Date: 15 Sep 2004 23:12:42 -0000 Message-ID: <20040915231242.3251.qmail () www securityfocus com> Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary MIME-Version: 1.0 X-Mailer: MIME-tools 5.411 (Entity 5.404) From: <admin () leetflash com> To: bugtraq () securityfocus com Subject: www.proboards.com / YaBB XSS Vuln A Cross Site scripting vulnerability exists currently for all boards of the ever popular www.proboards.com which has code based off of the popular YaBB Forums. This can result in an attacker stealing users Cookie Information and possible defacing/hijacking of the message board and its users accounts on the message board. The following code can be used to execute this XSS vuln: http://WEBSITE/index.cgi?board=[BOARDNAME]&action=display&num=[VALID TOPIC NUMBER]&"><script>alert(document.cookie);</script> Be Cautious of suspicous looking links. ################################## # -LJ Lemke leetflash () yahoo com # ##################################
Current thread:
- www.proboards.com / YaBB XSS Vuln admin (Sep 16)
- RE: www.proboards.com / YaBB XSS Vuln GulfTech Security (Sep 17)
- <Possible follow-ups>
- Re: www.proboards.com / YaBB XSS Vuln Patrick Clinger (Sep 17)