Nssboard, formerly Simple PHP forum, is vulnerable to HTML injection including scripts (possible XSS) in two ways:
1. If BBcode is disabled, HTML tags are no longer stripped, allowing XSS attacks, etc.
2. Profile information (user, email, Real Name) is not filtered. For example a user could use something like "<script>alert(document.cookie)</script> " as a Real name and the script would execute everytime someone views that users profile or the members page.
However the number of characters allowed in Real name is limited so it's unlikely too much damage could be done.
If XSS is allowed, it could allow for Session Hijacking.
I found this bug using version 6.1 of NSSboard (the latest as of this writing), and it's likely that all earlier versions are also affected, but I didn't test them. I am using Debian Linux and lighttpd to host it.
Pro version 8.6.5. Previous versions may also be affected.
V. WORKAROUND
A named pipe filter can be applied to the registry. Named pipe filtering
can be done in two ways dynamic filtering and white listing. Microsoft
provides further details about how to implement this workaround.
Named Pipe Filter workaround: http://support.microsoft.com/kb/925890
VI. VENDOR RESPONSE
document.getElementById("myForm").submit();
</script>
#########################
LFI
In quick.cart there are two ways to pass parameters to the script:
index.php?param1,param2,param3
or
index.php?p=param1-param2-param3
In first case our LFI is in param3 in second filename is in param1.
everything from open ports to IP ranges. The db_autopwn command now
cross-references across multiple ports and services name instead of a
single port, when the -p parameter is supplied.
All applicable exploits now have OSVDB references thanks to a major
effort by Steve Tornio. Two-ways links have been setup between the
Metasploit module browser and their matching OSVDB entries. CVE
references have been audited across the entire module tree, with a
number of typos and other fixes corrected in the process.
Oracle exploit support has been implemented through a tag-team effort
Posted On 03/15/2012
Last Updated On March 15, 2012
Advisory Contact Matt Jordan <mjordan AT digium DOT com>
CVE Name
Description An attacker can cause Asterisk to crash in one of two ways:
1. A dialplan uses the Milliwatt application with 'o'
option
2. The internal_timing opion in asterisk.conf is off
