Stored XSS in Boards.ie

900913

Oops! I accidentally added a stored XSS to boards.ie.

I made the post on the 18/3/2012 and while browsing boards I got an alert(1)
pop up.

I'll report it to a mod before posting the url:

Any mods online pm me...

900913

900913

bedlam wrote: »

Report it here

I reported it to MiCr0 who passed it on. But I didn't give any details about
which script of parameter is vulnerable.

900913

I just noticed that Damo2k had already reported this 4 days ago.
https://www.boards.ie/vbulletin/showthread.php?t=2056582381

There is also a reflected xss along with the stored xss.

On the Damo2k thread the title has been changed to "[Resolved] XSS"
When clearly it isn't.

pacquiao

900913 wrote: »

I just noticed that Damo2k had already reported this 4 days ago.
https://www.boards.ie/vbulletin/showthread.php?t=2056582381

There is also a reflected xss along with the stored xss.

On the Damo2k thread the title has been changed to "[Resolved] XSS"
When clearly it isn't.

you both found the same thing?

KoolKid

I have flagged this for Admin attention.

Boards.ie: Danny

Hi there,

Thanks for the report about an XSS vulnerability here on Boards. Please forward all relevant details such as the script involved, your example post etc to the tech team via PM.

The tech team are:

Boards.ie: Ciaran
Boards.ie: Danny
Boards.ie: Neil
Boards.ie: Paddy
Boards.ie: Ronan

900913

pacquiao wrote: »

you both found the same thing?

I cant really say we both found it cause for me it was more like I tripped over it.

I just clicked on ****** in boards.ie and while it was loading I went to a nother site I had opened. Next thing xss alert(1) pop-up.

I couldn't figure out which site it came from cause I had over 30 tabs open and I wasn't testing for xss. Then I opened the page source code for boards and seen my basic xss script (mods will probably delete this until hole is patched)

"/></Script><Script>alert(1)</Script>

Test code: "/></Script><Script>alert(1)</Script>
Test code 2:

"/></Script><Script>alert(1)</Script>

That when I realised it was a stored/persistent xss,dangerous stuff.

Arragh damo found it before me,(to be expected, the guys is a genius)

The admins deleted damo's thread in https://www.boards.ie/vbulletin/forumdisplay.php?f=228 probable because it the title was prefixed with the word Resolved. B]Resolved XSS[/B

Google cache of https://www.boards.ie/vbulletin/forumdisplay.php?f=228 before B]Resolved XSS[/B got removed.



They got it wrong but they are keen to fix/patch the vulnerability.

_AVALANCHE_

900913 wrote: »

What are all your browser addons?

Encode/Decode?
Proxies folder?
Other ones down bottom right corner?

900913

The Proxies folder is just bookmarked proxies that I used to use.
The Hackery folder is a download from http://code.google.com/p/pentest-bookmarks/ full of pentest site bookmarks.

CryptoFox - https://addons.mozilla.org/en-US/firefox/addon/cryptofox/

Noscript - https://addons.mozilla.org/en-US/firefox/addon/noscript/

Adblock Plus - https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

Phzilla proxy - https://addons.mozilla.org/en-US/firefox/addon/phzilla/

Xmarks - https://addons.mozilla.org/en-US/firefox/addon/xmarks-sync/

FoxyProxy - https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

Server Spy - https://addons.mozilla.org/en-US/firefox/addon/server-spy/

Screen Grab - https://addons.mozilla.org/en-US/firefox/addon/screengrab/

FlagFox - https://addons.mozilla.org/en-US/firefox/addon/flagfox/

Cookies Manager+ 1.5.1 - https://addons.mozilla.org/en-US/firefox/addon/cookies-manager-plus/

Tab mix Plus - https://addons.mozilla.org/en-US/firefox/addon/tab-mix-plus/

Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

*edit

SecFox - Addons For Security Analysts/Pentesters
https://addons.mozilla.org/en-us/firefox/collections/rajivvishwa/secfox/

_AVALANCHE_

Thanks for such a detailed response!:)

Do Phzilla and Foxy Proxy work well?

_AVALANCHE_

900913 wrote: »

Server Spy - https://addons.mozilla.org/en-US/firefox/addon/server-spy/


Tamper Data - https://addons.mozilla.org/en-US/firefox/addon/tamper-data/

Do you work in this area? I'm guessing yes from reply in this Thread, complicated stuff.

900913

_AVALANCHE_ wrote: »

Do you work in this area? I'm guessing yes from reply in this Thread, complicated stuff.

??? Don't know what you mean. There's 1,000's of addons and tools better than the firefox addons listed.

I occasionally test the odd site and pass the flaws onto the site admins.

All Whitehat, Occasionally grey but never black.

Many site admins act offended when you give them info that proves there sites have vulnerabilities.


*edit
BTW I learned all this stuff online, from similar sites to them.

http://www.boards.ie/vbulletin/showpost.php?p=77585542&postcount=8