########################## www.BugReport.ir ####################################### # # AmnPardaz Security Research Team # # Title: MegaBBS Forum Multiple Vulnerabilities. # Vendor: http://www.pd9soft.com/ # Vulnerable Version: 2.2 # Exploit: Available # Impact: Medium # Fix: N/A # Original Advisory: http://bugreport.ir/index.php?/37 ################################################################################### #################### 1. Description: #################### A complete, fully featured ASP website system. Includes an extremely powerful forum, calendars, polls, and photo albums. Best of all, it's completely free! Find out why MegaBBS is one of the fastest growing ASP messaging portals available today. #################### 2. Vulnerability: #################### 2.1. There is a SQL Injection in "/forums/attach-file.asp" in "attachmentid" parameter. 2.1.1. POC: Check the Exploit/POC section. 2.3. There is a XSS in "/admin/impersonate.asp". 2.3.1. POC: /admin/impersonate.asp?redirect=javascript:alert('XSS')&action=end 2.2. There is a SQL Injection in "/profile/controlpanel.asp" in "invisible" and "timeoffset" parameters. 2.2.1. POC: Check the Exploit/POC section. 2.4. There is a XSS in "send-private-message.asp". This XSS needs authentication. 2.4.1. POC: Check the Exploit/POC section. #################### 3. Exploits/POC: #################### Original Exploit URL: http://bugreport.ir/index.php?/37/exploit 3.1. "/forums/attach-file.asp" SQL Inection POC: -------------
File :
------------- 3.2. "/profile/controlpanel.asp" SQL Injection POC: -------------
Injection1 (Numeric Update):
Injection2 (Numeric Update):
------------- 3.3. "send-private-message.asp" XSS POC: -------------

------------- #################### 4. Solution: #################### Edit the source code to ensure that inputs are properly sanitised. #################### - Credit : #################### AmnPardaz Security Research & Penetration Testing Group Contact: admin[4t}bugreport{d0t]ir WwW.BugReport.ir WwW.AmnPardaz.com