InvisionPower cms Links to Titles utility Presistent XSS =========================================== #Author: UmPire #Version: 3.0   (Full details for version 3.1 patch is not mentioned. It's suspicious to affect all versions.) #Vendor URL: http://invisionpower.com #Product URL: http://community.invisionpower.com/files/file/3784-links-to-titles/ #Tested: Windows 7 ______________________________________________ IPB "Links to Title" mod converts links to the link's title. It converts "http://www.google.com" to "Google" and the href= remains http://www.google.com The problem is that it doesn't convert html tags to safe html characters. So if we use an html code in the title of the source page, it will be executed in the InvisionPower cms which "Links to Title" is installed on. ______________________________________________ #Product Detection: http://localhost:80/admin/applications/forums/sources/classes/linkTitlesFunctions.php ~ 200 OK #POC:     Enter a link in invision power cms: http://localhost:80/test.html     Contents of test.html:             <script>alert('xss')</script>         #Video: https://www.youtube.com/watch?v=ap23bnsK8Vg #Credits: Iran Security Group - iransec.net Thanks to Root.Smasher|Black V!per|ali ahmady|Mr.Moein|Sultan Brain|Alireza_Promis|M4hdi|Social Engineer|TaK.FaNaR|LinuxLover|Saeed.Jok3r Email: ranrep0ker@yahoo.com #TimeLine: 2014/04/30 --> Found the bug. 2014/05/03 --> Contacted IPS Official Site.(told me to contact the third-party author) 2014/05/04 --> Sent message to third-party author (programmer of "Links to Title") -> No reply 2014/05/05 --> Published the bug.