|
|
|
|
| Aw: Re: FUDforum 3.0.4.1 released |
Sun, 16 September 2012 19:22 |
|
|
StephenKing schrieb am Sat, 15 September 2012 09:04You've already heard of responsible disclosure?
I'm sorry. It's the first vulnerability I ever found and I did not really know how to react. I was a little bit nerveous and didn't think enough about my practice.
|
|
| Re: Cross-site scripting attacks |
Sun, 16 September 2012 12:33 |
|
|
Details would be great!
If you don't want to respond to my private mail, please post it here so it can be validated and fixed.
|
|
|
|
| Cross-site scripting attacks |
Thu, 13 September 2012 10:46 |
|
|
Hi!
I've found a critical bug in FUDforum that can be used for a Cross-site scripting attack.
An attacker could generate a special prepared data-URL which contains a HTML document with java script code and put a link to it into a forum message. This code will be executed in the context of the forum domain if any user clicks at the link.
So with Ajax the script can read out the SQ or other data and do anything.
All versions of FUDforum (at least since 2.7.7) are affected. I think earlier versions than 2.7.7 will also be affected, but I did not try it out.
I think you should really disable data-URLs in hyperlinks.
|
|
Calendar
Search
Help
Members
Control Panel
Logout [ CommonCrawl [Bot] ]
Home