ihostinghq.md

http://www.ihostinghq.com/newspost/18791

"This update also comes with many bug fixes and security patches. Many thanks to Fabian Fäßler of http://www.smrrd.de for pointing out several vulnerabilities."

ihostinghq_vuln.md

this is one of the several vulnerabilities:

Stored XSS in iClan Websites BBCode Parser

Class:          Stored XSS
Severity:       High
Affects:        iClan Websites BBCode Parser
Resolved:       resolved

I. Background

iClan Websites is a simple to use website management system designed
for clans and gamers. With loads of themes and hundreds of features,
it's used by all types of teams.

II. Problem Description

The BBCode Parser doesn't parse input properly. A special crafted
string will result in a stored XSS.


[img][url=//onerror=eval(String.fromCharCode(97,108,101,114,116,40,34,88,83,83,34,41))//][/url][/img]

III. Impact

A stored XSS targets legitimate users and can be used to gather information,
phish credentials, steal cookies and more.

IV. Workaround

Disable BBCodes.
update: fixed by vendor. No action required.

V. Solution

fixed by vendor. No action required.

VI. References

Blog Article about XSS with BBCodes: http://jeffchannell.com/Other/bbcode-xss-howto.html
Talk about hacking a browsergame with BBCode XSS (german): http://vimeo.com/channels/409924/35601597