A remote user can conduct cross-site scripting attacks...

[Katze]

Hallo,

da ich kein englisch kann, muss ich hier nachfragen.
Ein Mitglied meines Forums hat mir heute die folgende Private Nachricht geschickt - mit dem Zusatz, dass er es nicht öffentlich posten wollte.
Es scheint um ein Sicherheitsproblem zu gehen, aber was genau usw. lese ich leider nicht raus.

Schonmal Danke für Eure Hilfe.

Der Text:

phpBB2 Input Validation Flaw Lets Remote Users Insert Scripting Code into Certain HTML Tags to Conduct Cross-Site Scripting Attacks

Version(s): 2.0.3
Description: An input validation vulnerability was reported in the phpBB2 forum software. A remote user can conduct cross-site scripting attacks against phpBB2 users when the server is configured

Sec-Tec Ltd reported that if phpBB2 is configured to allow the use of certain html tags for text formatting, a remote user can insert the following type of text into a user post:

This piece of text could be dangerous if you were to move your mouse over it!
This piece of text could be dangerous"
if you were to click it!
This piece of text could be dangerous if you
were to click it!

This will cause a target user's browser to execute arbitrary scripting code when the target user places their mouse over the affected text. The code will originate from the site running phpBB2 and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running phpBB2, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution: No solution was available at the time of this entry.

The vendor reportedly suggests that you disable the ability to post messages containing HTML and require users to use BBCode instead.

[Pacman]

Hi,

Ich glaube es geht dabei um dieses Sicherheitsproblem:
http://www.phpbb.de/viewtopic.php?t=18356

Bye

[Katze]

Dankeschön.
Den Thread hatte ich nicht entdeckt.

Katze