Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS

[Emanuele <emanuele45 () gmail com>]

Hello,

my name is Emanuele, and I'm one of the current SMF developers.

Moritz Naumann wrote:
> On 31.12.2012 11:42 Henri Salo wrote:
> [..]
>   
> > Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this.
I'm sorry nobody answered.

> > Please note there is several comments[1][2] in forums about this too.
> >
> >     
> [..]
>   
> > It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT 
> > CVE-2012-5903?
> >     
> Based on the authors' description it would seem more likely that the
> attack would use social engineering to trick the legitimate forum admin
> into accessing this URL with a payload in it, which would then trigger
> in his browser and disclose the admins' session cookie to an attacker by
> means of cross site scripting. Like you, I don't see how the value
> passed to the "scheduled" parameter would be echoed out, though.
>   

As I wrote in my post the scheduled parameter doesn't output anything on
the screen. It is just used to decide what action should be taken.
Relevant code involved:
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/index.php#L81
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/ScheduledTasks.php#L27
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/ScheduledTasks.php#L132
These are the only instances of "scheduled" in the entire codebase (the
code is from the future SMF 2.1 version, but it didn't change from 2.0).

Kindred answer (comment [1]) is not relevant. He was probably referring
to another bug we fixed with the latest patch (2.0.3).

1:
http://www.simplemachines.org/community/index.php?topic=491516.msg3445272#msg344527

> While it doesn't directly impact treatment of this latest report, I'd
> like to point out that there has been a previous report by the same
> author on the same product back in october, which I was also unable to
> reproduce:
>
>   
[...]
> http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html
>   
And again the "view" is only used to decide the action, but it is not
used to produce any output.

Thank you for the email.

Best regards,
Emanuele