Date: Mon, 31 Dec 2012 15:14:26 +0100 From: Moritz Naumann <oss-security@...itz-naumann.com> To: oss-security@...ts.openwall.com CC: henri@...v.fi, security@...plemachines.org, irist.ir@...il.com Subject: Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS On 31.12.2012 11:42 Henri Salo wrote: [..] > Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this. Please note there is several comments in forums about this too. > [..] > It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT CVE-2012-5903? Based on the authors' description it would seem more likely that the attack would use social engineering to trick the legitimate forum admin into accessing this URL with a payload in it, which would then trigger in his browser and disclose the admins' session cookie to an attacker by means of cross site scripting. Like you, I don't see how the value passed to the "scheduled" parameter would be echoed out, though. While it doesn't directly impact treatment of this latest report, I'd like to point out that there has been a previous report by the same author on the same product back in october, which I was also unable to reproduce: From: irist.ir@...il.com To: bugtraq@...urityfocus.com Date: Tue, 23 Oct 2012 19:20:10 GMT Subject: Smf 2.0.2 Cross-Site Scripting Vulnerability # Exploit Title : Smf 2.0.2 Cross-Site Scripting Vulnerability # # Author : IrIsT.Ir # # Discovered By : Am!r http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html Same for a supposed vulnerability in Wordpress which was reported the day after: From: irist.ir@...il.com To: bugtraq@...urityfocus.com Subject: Wordpress 3.4 Cross-Site Scripting Vulnerability # Exploit Title : Wordpress 3.4 Cross-Site Scripting Vulnerability # # Author : IrIsT.Ir # # Discovered By : Am!r I contacted the sender address back then, pointing out that: > it's an XSS if the application returns the input in an unencoded way, > allowing an attacker (or victim) to inject script code into the > applications output. I don't see how this is the case with the SMF or > Wordpress code you quoted. I have not received a reply. Moritz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.