phpBB 2.0.21 XSS in administration ********************************** //-- By Blwood [renatrix@gmail.com] //-- [ http://www.blwood.net ] //-- Style Admin ----------- Management & Create a theme Lots of input are not properly "filtrate" like style_name, head_stylesheet, body_background, tr_color1_name (all the input in simple name)... We cand ofcourse inject html in this way : ">

Owned by Blwood :P

but it's more interresting to inject javascript :) : "> => style_name "> => head_stylesheet, body_background, ... When an admin will go in Style Administration he will be Owned. (inject in style_name) When an admin will edit a them he will be Owned. Group Administration -------------------- Management Input group_description is not correctly "filtrated" we can inject js like this : "> or "> When an admin will go in Group administration he'll be owned. But what's more, the groups can be seen in groupcp.php by every visitors. An exploit could be : "> or "> Ranks ----- Rank Administration Rank Title (input title) is not correctly filtrated, we can inject js like : "> But what's interresting, if you give this rank to an user, the rank will appear in user's topics and the code will be executed when someone sees a topic :) Now you can inject what you want but maximum 40 caracters... Smilies ------- Smiles Editing Utility Smiley Code : "> Configuration ------------- General Configuartion Inputs are not correctyle filtrated : Ex : allow_html_tags => "> [ Video ] http://www.blwood.net/advisory/phpbb2021xssadmin.rar