#################################################
Vikingboard multiple Cross site scripting
Vendor url: http://vikingboard.com/
advisore:http://lostmon.blogspot.com/2007/07/
vikingboard-multiple-cross-site.html
vendor notify:yes exploit include:yes
#################################################


Vikingboard is a PHP-based community board designed by
the principle of "less is more", and features a powerful
web-based extension-system, a lighting-fast cache system
and dynamic web update. Small, but incredibly fast and powerful.



Vikingboard contains a flaw that allows a remote cross site
scripting attack.This flaw exists because the application does
not validate multiple params upon submission to multiple scripts
.This could allow a user to create a specially crafted URL that
would execute arbitrary code in a user's browser within the
trust relationship between the browser and the server,
leading to a loss of integrity.



################
versions
################

Vikingboard 0.1.2


################
Solution:
################

No solution was available at this time !!!

################
TimeLine
################

Discovered: 20-07-2007
vendor notify: 25-07-2007
vendor response:
disclosure:25-07-2007


#####################
Examples
#####################


http://localhost/viking/cp.php?mode=9&id=2[XSS-CODE]
http://localhost/viking/cp.php?mode=7&f=1[XSS-CODE]
http://localhost/viking/cp.php?mode=6"e=1[XSS-CODE]
http://localhost/viking/cp.php?mode=12&act=[XSS-CODE]

http://localhost/viking/user.php?u=2[XSS-CODE]
http://localhost/viking/help.php?act=guidelines[XSS-CODE]


we can call the debug parameter to obtain sensitive information.


http://localhost/viking/post.php?mode=00&f=1[XSS-CODE]&poll=0

wen send a private message the field "Message Title " is affected

http://localhost/viking/cp.php?mode=6

we can send a PM with a malformed XSS title to others users
and it is executed wen the vicims go to Inbox on his control panel

http://localhost/viking/cp.php?mode=7&f=1

http://localhost/viking/report.php?p=2[XSS-CODE]


http://localhost/viking/topic.php?t=2&s=0[XSS-CODE]

http://localhost/viking/post.php?mode=03&t=2"e=2[XSS-CODE]
http://localhost/viking/post.php?mode=03&t=2[XSS-CODE]"e=2
http://localhost/viking/post.php?mode=00&f=1&poll=0[XSS-CODE]

http://localhost/viking/post.php?mode=02&p=2[XSS-CODE]

http://localhost/viking/search.php?search=user:administrator&act=dosearch

if the user has any script code in the first lines of any post
wen try fo find all post by this user , and wen the applications
show the results it is executed

##################### €nd ##############################

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)