Re: www.proboards.com / YaBB XSS Vuln

[Patrick Clinger <pclinger@xxxxxxxxxxxxx>]

In-Reply-To: <20040915231242.3251.qmail@xxxxxxxxxxxxxxxxxxxxx>

This flaw has been fixed.

I would like to take this opportunity to first state that ProBoards does not 
run on YaBB software as the author of this thread implies.  We run on our own 
in-house developed software, which the YaBB team will vouch for.

Also I would like to note that we were not notified of this vulnerability until 
last last night, nearly 24 hours after it was posted here.  I respectfully 
request of the author of this post to first contact the vendor as is the 
standard courtesy for these situations.  Not contacting the vendor first is 
irresponsible.

Patrick Clinger
ProBoards.com

>Received: (qmail 10060 invoked from network); 16 Sep 2004 20:37:50 -0000
>Received: from mail2.securityfocus.com (205.206.231.1)
>  by mail.securityfocus.com with SMTP; 16 Sep 2004 20:37:50 -0000
>Received: (qmail 18319 invoked by alias); 16 Sep 2004 20:18:24 -0000
>Delivered-To: archive-bugtraq@xxxxxxxxxxxxxxxxx
>Received: (qmail 18302 invoked from network); 16 Sep 2004 20:18:24 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing2.securityfocus.com) 
>(205.206.231.26)
>  by mail2.securityfocus.com with SMTP; 16 Sep 2004 20:18:24 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com 
>[205.206.231.20])
>       by outgoing2.securityfocus.com (Postfix) with QMQP
>       id 37B7E143E09; Thu, 16 Sep 2004 09:24:09 -0600 (MDT)
>Mailing-List: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@xxxxxxxxxxxxxxxxx>
>List-Help: <mailto:bugtraq-help@xxxxxxxxxxxxxxxxx>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@xxxxxxxxxxxxxxxxx>
>List-Subscribe: <mailto:bugtraq-subscribe@xxxxxxxxxxxxxxxxx>
>Delivered-To: mailing list bugtraq@xxxxxxxxxxxxxxxxx
>Delivered-To: moderator for bugtraq@xxxxxxxxxxxxxxxxx
>Received: (qmail 29611 invoked from network); 15 Sep 2004 16:58:21 -0000
>Date: 15 Sep 2004 23:12:42 -0000
>Message-ID: <20040915231242.3251.qmail@xxxxxxxxxxxxxxxxxxxxx>
>Content-Type: text/plain
>Content-Disposition: inline
>Content-Transfer-Encoding: binary
>MIME-Version: 1.0
>X-Mailer: MIME-tools 5.411 (Entity 5.404)
>From: <admin@xxxxxxxxxxxxx>
>To: bugtraq@xxxxxxxxxxxxxxxxx
>Subject: www.proboards.com / YaBB XSS Vuln
>
>
>
>A Cross Site scripting vulnerability exists currently for all boards of the 
>ever popular www.proboards.com which has code based off of the popular YaBB 
>Forums.
>
>This can result in an attacker stealing users Cookie Information and possible 
>defacing/hijacking of the message board and its users accounts on the message 
>board.
>
>The following code can be used to execute this XSS vuln:
>
>http://WEBSITE/index.cgi?board=[BOARDNAME]&action=display&num=[VALID TOPIC 
>NUMBER]&">&lt;script&gt;alert(document.cookie);&lt;/script&gt;
>
>Be Cautious of suspicous looking links.
>
>##################################
># -LJ Lemke  leetflash@xxxxxxxxx #
>##################################
>