########################## www.BugReport.ir #######################################
#
#      AmnPardaz Security Research Team
#
# Title: MegaBBS Forum Multiple Vulnerabilities. 
# Vendor: http://www.pd9soft.com/
# Vulnerable Version: 2.2
# Exploit: Available
# Impact: Medium
# Fix: N/A
###################################################################################


####################
1. Description:
####################
A complete, fully featured ASP website system. Includes an extremely powerful forum, calendars, polls, and photo albums. Best of all, it's completely free! Find out why MegaBBS is one of the fastest growing ASP messaging portals available today.

####################
2. Vulnerability:
####################
	2.1. There is a SQL Injection in "/forums/attach-file.asp" in "attachmentid" parameter.
		2.1.1. POC:
				Check the Exploit/POC section.
	2.3. There is a XSS in "/admin/impersonate.asp".
		2.3.1. POC:
				/admin/impersonate.asp?redirect=javascript:alert('XSS')&action=end
	2.2. There is a SQL Injection in "/profile/controlpanel.asp" in "invisible" and "timeoffset" parameters.
		2.2.1. POC:
				Check the Exploit/POC section.
	2.4. There is a XSS in "send-private-message.asp". This XSS needs authentication.
		2.4.1. POC:
				Check the Exploit/POC section.
####################
3. Exploits/POC:
####################
 
 Original Exploit URL: http://bugreport.ir/index.php?/37/exploit
 
####################
4. Solution:
####################
	Edit the source code to ensure that inputs are properly sanitised.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com