In the web forum creation engine several have been identified , allowing the organization of a multi-step attack to execute arbitrary PHP code on the server. The issues have been resolved in the release .
The first vulnerability is present in the publication and private messaging modules, allowing for the injection of JavaScript code (XSS), which will be executed in the browser when viewing a post or received message. JavaScript injection is possible due to incorrect conversion of nested BBCode into HTML. Specifically, the tag
«
and it will be converted into the tag when processing BBCode
‹iframe src="youtube.com/xyz[url]http://onload=evilCode()[/url]"›‹/iframe›
, and after processing other BBCode into
‹iframe src="youtube.com/xyz‹a href="http://onload=evilCode()"›.."›‹/iframe›
Accordingly, the double quote in 'href="' closes the 'src' attribute, and onLoad is processed in the context of the iframe.
The second vulnerability allows an administrator of the forum to save a PHP script to the web server's file system and execute it. The issue is present in the style management code for the active theme, which allows the generation of new CSS files. Such files are saved with a '.css' extension, but the field size in the database for the file name is limited to 30 characters. Accordingly, a file can be named "26characters.php.css". When written to the database, extra characters will be truncated, and ultimately the name "26characters.php" will be saved. Then, through the forum's admin panel, a new style can be generated, and the file will be written to the 'cache' directory with a php extension.
To carry out the attack, the attacker can send the forum administrator a specially crafted message or post a similar message on the forum. When this message is viewed in the browser during the current session on the forum and with the rights of the user viewing the message, the specified JavaScript code provided by the attacker will be executed. If the message was viewed by the administrator, the second vulnerability is exploited to execute PHP code in the context of a privileged session.
Source: opennet.ru
