Phpbb "allow Html" Script Insertion Security Issue

[Brandon]

Story published by Secunia

Source: Maksymilian Arciemowicz

Maksymilian Arciemowicz has discovered a security issue in phpBB, which can be exploited by malicious people to conduct script insertion attacks.

Input passed in the message body when posting isn't properly sanitised before being used. This can be exploited to inject arbitrary JavaScript code, which will be executed in a user's browser session in context of an affected site when the malicious post is viewed.

Example:

<B C=">" onmouseover="

" X="<B "> H E L O </B>

Successful exploitation requires that "Allow HTML" is enabled (not default setting).

It is also possible to disclose the full path to "admin/admin_disallow.php" by accessing it directly with the "setmodules" parameter set to "1" (requires that "register_globals" is enabled).

The security issue has been confirmed in version 2.0.18. Other versions may also be affected.

[b]Solution:[/b]

Set "Allow HTML" to "No".

Secunia Advisory

[Pierce]

Yet another possible security vunrability in phpbb, thank god this forum uses invision board

Pierce

[Brandon]

Yet another possible security vunrability in phpbb, thank god this forum uses invision board

Pierce

Agreed