Home » 2009 » December » 10 » IPB v2.x up to 3.0.4 XSS vulnerability
1:55 PM
IPB v2.x up to 3.0.4 XSS vulnerability
[+] Invision Power Board XSS vulnerability

       Software : Invision Power Board (IPB)
       Affected : IPB v2.x up to v3.0.4 (prior versions might be vulnerable as well)
       Remote   : Yes
       Required : Internet Explorer +5.0
       Vendor   : http://www.invisionpower.com/
       Download : Commercially available
       Author   : Xacker
       Contact  : N/A
       Blog     : http://xacker.wordpress.com
       Website  : N/A

[+] Technical details

       IP.Board is prone to XSS attacks through maliciously crafted *.txt
files attachments. An attacker has to convince a user to view the
malicious file in order to run the evil code.

       The only browser found affected is Internet Explorer +5.0, other
browsers (FF/Chrome/Opera..) seems to handle the issue correctly (or
simply blindly?)

       IP.Board v2.x set the MIME-type of *.txt files to
(application/x-dirview). If the *.txt file contains JavaScript/HTML it
will simply be parsed on IE +5.

       IP.Board v3.0.4 (and prior) seems to check the content of the files
before permitting them, tags like "<body> , <script> , etc.." are
flagged *dangerous* any file containing any of them simply fail to be
uploaded. The filter itself is weak, to escape it I provide a
proof-of-concept code below.

[+] Exploit

       <span onmouseover="javascript:alert('XSS');function
fakeLoginPage(){...}">move your mouse pointer here</span>

       fakeLoginPage() function can be used to rewrite the whole page,
faking a login page through an embedded iframe.

[+] Fix

       Simply change MIME-type of *.txt files (and any other similar
formats) to (text/plain).

[+] Note

       IP.Board technical staff has been notified of the issue and a fix has
been released couple of days ago:
Views: 52893 | Added by: b1zz4rd | Rating: 0.0/0
Total comments: 1071 2 3 ... 10 11 »
Hi new blog
free downloads adult porn porn star studio arizona address jax beach porn tentical porn hentai best free porn 10

Started untrodden spider's web stand out
enema teen porn free porn tube enema explosion top best porn sites nicole moorejew porn stacy adams porn video

Hi supplementary website
online watched porn soft porn streaming old amateur home free porn videos free big busty threesome porn free midget porn tgp

Started unusual spider's web predict
1950 classic porn porn abbit porn sharia free lesbian action porn office girls girls doing porn

New devise
top ratdd vintage tube porn sites 3g free porn girl fucking dog sick porn tgp soft porn moies pro images porn

Study my altered contract
youtube format gay porn ayler lie porn intporn hot blondes in porn mum and son porn video plastic knickers free porn photos

Hi reborn website
porn stars of spain nasty porn compilations free cute little porn pics bbw nasty porn vidoes hawaiian girl porn

My contemporary time
what is a good porn movie free lol porn kianna porn tube pokemon porn of may dutch wife swap video porn

http://www.ti-auto.ru/ - твари ломают машины

Really Gr8 ! Thanks For sharing..

1-10 11-20 21-30 ... 91-100 101-107
Name *:
Email *:
Code *: