######################################################################
#
# BlackBoard Academic Suit 6.3.1 Messages <= XSS Vulnerability
#
# Date			: 30-september-2007
# Vendor URL		: http://www.blackboard.com
#
# Found By		: Rubén Ventura Piña (Trew)
# Contact Info		: http://trew.icenetx.net
#			  trew.revolution@gmail.com
#			  ICEnetX Team - http://icenetx.net
#
######################################################################
#
#  Greetings oh earthlings: 
#	Ayzax, BRIO, Gaper, (All ICEnetX Team), n3, Tog, ta^3, Paisterist,
#	and to all people who likes H.I.M, lol.
#
#	"Maybe you can't break the system, but you can always hack it."
#
######################################################################
#
## Vulnerability ##
#
# The Blackboard Learning System is a software application for
# institutions dedicated to teaching and learning, wich provides various
# communication services for it's users. Versions 6.3.1.5x and prior (and
# possibly newer versions) are vulnerable to a persistent XSS attack.
#
# This System features a Messages area (located under the Communication
# section), for students and instructors to send private messages to
# other users. The vulnerability is located within this page.
#
# Input passed to the "subject_t" and "body_text" parameters in the
# "Compose Message" page (generally messaging/course/composeMessage.jsp
# is not properly santised.
# This can be exploited to inject script code into the page, and as a result
# conduct a persistente XSS attack.
#
# Input passed to the "subject_t" parameter is not validated in any way,
# so a script insertion can be acheived by simply inserting code into
# the subject field.
#
# Input passed to the "body_text" is validated by a JavaScript function before
# the message is sent, but this filter can be easily bypassed using a
# Man-in-the-Middle software (like Achilles or TamperData) to change the modified
# message into the original one, when the message is being sent.
#
# Once the victim goes to his Inbox, the attacker will be able to execute
# arbitrary script code in the victim's browser.
#
## How to fix ##
#
# Santise all the form fields properly (trying to avoid javascript functions).
#
# wawawa
#
[EOF]