Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS

[Moritz Naumann <oss-security () moritz-naumann com>]

On 31.12.2012 11:42 Henri Salo wrote:
[..]
> Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this. Please note 
> there is several comments[1][2] in forums about this too.
[..]
> It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT 
> CVE-2012-5903?

Based on the authors' description it would seem more likely that the
attack would use social engineering to trick the legitimate forum admin
into accessing this URL with a payload in it, which would then trigger
in his browser and disclose the admins' session cookie to an attacker by
means of cross site scripting. Like you, I don't see how the value
passed to the "scheduled" parameter would be echoed out, though.

While it doesn't directly impact treatment of this latest report, I'd
like to point out that there has been a previous report by the same
author on the same product back in october, which I was also unable to
reproduce:

From:    irist.ir () gmail com
To:      bugtraq () securityfocus com
Date:    Tue, 23 Oct 2012 19:20:10 GMT
Subject: Smf 2.0.2 Cross-Site Scripting Vulnerability

# Exploit Title : Smf 2.0.2 Cross-Site Scripting Vulnerability
#
# Author        : IrIsT.Ir
#
# Discovered By : Am!r

http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html


Same for a supposed vulnerability in Wordpress which was reported the
day after:

From:    irist.ir () gmail com
To:      bugtraq () securityfocus com
Subject: Wordpress 3.4 Cross-Site Scripting Vulnerability

# Exploit Title : Wordpress 3.4 Cross-Site Scripting Vulnerability
#
# Author        : IrIsT.Ir
#
# Discovered By : Am!r



I contacted the sender address back then, pointing out that:

> it's an XSS if the application returns the input in an unencoded way,
> allowing an attacker (or victim) to inject script code into the
> applications output. I don't see how this is the case with the SMF or
> Wordpress code you quoted.

I have not received a reply.

Moritz