Title: ZeroBoard Multiple Remote Script Injection And Cross-Site Scripting Vulnerabilities
Severity: HIGH
Description:
ZeroBoard is a web-based bulletin board application implemented in PHP.
Multiple script injection and cross-site scripting vulnerabilities reportedly affect ZeroBoard. These issues are due to a failure of the application to properly sanitize user-supplied input.
The first problem presents itself when the URI of a remote PHP script is passed to the application through the '_zb_path' parameter of the 'outlogin.php' script. As of PHP version 5.0.0 the 'file_exists()' PHP function supports remotely located files. The affected application fails to properly sanitize the '_zb_path' parameter before passing it to the 'file_exists()' function, and thus facilitating the script injection issue.
The second issue is also due to the can be triggered when an attacker specifies a remote directory through the 'dir' parameter of the 'write.php' script. Apparently the affected application uses the 'dir' parameter to include the 'write.php' file using the call 'include $dir."/write.php"'. An attacker could leverage this issue by crafting a malicious PHP file named 'write.php' and hosting it on a public server. The attacker would then pass the location of their malicious file through the offending parameter of the affected application in order to have it executed.
Finally a cross-site scripting vulnerability exists in the 'user_id' parameter of the 'check_user_id.php' script. This issue may allow an attacker to have arbitrary client-side script code executed in the browser of an unsuspecting user.
An attacker may leverage these issues to execute arbitrary server-side scripts and carry out cross-site scripting attacks against unsuspecting users. This may facilitate a compromise of the host computer, as well as theft of cookie-based authentication credentials. Other attacks are also possible.
Affected Products:
- Zeroboard Zeroboard 4.1.0 pl3
- Zeroboard Zeroboard 4.1.0 pl4
- Zeroboard Zeroboard 4.1.0pl2
References:
- Zeroboard: Zeroboard Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
