[FD] QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability

Document Title: =============== QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability References (Source): ==================== http://ift.tt/2aO6sFJ Release Date: ============= 2016-08-11 Vulnerability Laboratory ID (VL-ID): ==================================== 1895 Common Vulnerability Scoring System: ==================================== 3.2 Product & Service Introduction: =============================== QuickerBB is a fast forum. It is based on PHP5 with databases SQLite and MySQL via PDO. The easy setup forum web-application is in use by several tor protected shopping websites. (Copy of the Homepage: http://ift.tt/2aUK7YD ) Abstract Advisory Information: ============================== The vulnerbaility laboratory core research team discovered multiple client-side cross site vulnerabilities in the QuickerBB v0.7.0 Forum web-application. Vulnerability Disclosure Timeline: ================================== 2016-08-11: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== QuickerBB Product: QuickerBB - Forum (Web-Application) 0.7.0 and 0.6.0 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ Multiple client-side cross site scripting vulnerabilities has been discovered in the QuickerBB v0.7.0 Forum web-application. The vulnerability allows remote attackers to inject own malicious script codes to client-side browser to web-application requests. The cross site scripting vulnerabilities are located in the `username` and `email` parameters of the `Register` module. Remote attackers are able to inject own malicious payloads to the client-side requested register module of the index.php file. The injection points are the vulnerable marked parameters and the execution point occurs in the forum registration form web context. The request method to inject is POST and the attack vector of the issue is non-persistent. The security risk of the xss vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.2. Exploitation of the client-side vulnerabilities requires no privileged web-application user account and only low user interaction. Successful exploitation of the vulnerability results in non-persistent phishing attacks, session hijacking, non-persistent external redirect to malicious sources and non-persistent manipulation of affected or connected web module context. Request Method(s): [+] POST Vulnerable Module(s): [+] Register Vulnerable File(s): [+] index.php Vulnerable Parameter(s): [+] username [+] email Proof of Concept (PoC): ======================= The client-side vulnerabilities can be exploited by remote attackers without privileged user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Manual steps to reprduce the vulnerability ... 1. Open the forum web-application without authentication 2. Open the register module with click to the link 3. Inject to the username or email inputs own script code payload 4. The execute occurs when processing to click the submit button for the POST method request 5. Successful reproduce of the client-side cross site scripting web vulnerability! PoC: Vulnerable Source (./index.php?act=register)

QuickerBB fast forum software

Log in    Register

Home => Register

Error with Username, Password or Email. 

Source: Gmail -> IFTTT-> Blogger

Username

<[CLIENT-SIDE SCRIPT CODE EXECUTION!] " size="32" maxlength="25" required/> 3 to 25 characters