Mercuryboard forum.php f variable XSS

################################################
Mercuryboard 1.0.x & 1.1.x forum.php f variable XSS
vendor url: http://www.mercuryboard.com
advisore:http://lostmon.blogspot.com/2005/02/
mercuryboard-forumphp-f-variable-xss.html
exploit avaible :yes vendor: emailed
OSVDB ID 13764
Secunia:SA13937
Securitytracker:1013223
################################################


MercuryBoard is a powerful message board system dedicated to raw speed with a mixture of features, ease of use, and ease of customization coupled with expandability, and diverse language services

Mercuryboard contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate 'f' variable upon submission to the 'forun.php' script.This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

afected versions :

1.0.x
1.1.x


Proof of concept

http://[victim]/index.php?a=forum&f='%3E%3Cscript%3Ealert
(document.cookie)%3C/script%3E

http://[victim]/index.php?a=forum&f='><script>alert
(document.cookie)</script>

impact:

Loss of confidenciality
Information disclosure
path disclosure
imput manipulation.

solution:

Currently, there are no known upgrades, patches, or workarounds available to correct this

issue.


release time :

discovered : 2005-02-13
Email to vendor: 2005-02-13
disclosure date: 2005-02-16

Atentamente:

Lostmon (lostmon@gmail.com)

Thnx to estrella Ke tailoviu un monton :P
thnx to all for the support.

http://Lostmon.blogsport.com/

--
La curiosidad es lo que hace mover la mente....