[MajorSecurity Advisory #52]ActualAnalyzer family - Cross Site Scripting Issues
Details ======= Product: Actual Analyzer Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.actualscripts.com Vendor-Status: informed Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz http://www.majorsecurity.de Affected Products: ---------------------------- ActualAnalyzer Server 8.37 and prior ActualAnalyzer Gold 7.74 and prior ActualAnalyzer Pro 6.95 and prior Actual Analyzer Lite 2.78 and prior Original Advisory: ============ http://www.majorsecurity.de/index_2.php?major_rls=major_rls52 Introduction ============ ActualAnalyzer is a powerful statistics-gathering and analysis tool for monitoring web site traffic. It is equally effective for sites with low and high volumes of traffic and provides a wealth of comparative and analytical information. More Details ============ Cross Site Scripting: Input passed directly to the "language" parameter in "view.php" is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. PoC: ============= /view.php?&language=>"><script>alert(15031988)</script> Solution ============= Edit the source code to ensure that input is properly sanitised. You should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags and javascript code are not going to be executed. Example: <?php $pass = htmlentities($_POST['pass']); $test = htmlspecialchars($_GET('test')); ?> History/Timeline ================ 05.05.2008 discovery of the vulnerabilities 05.05.2008 additional tests with other versions 07.05.2008 contacted the vendor 12.05.2008 advisory is written 13.05.2008 advisory released MajorSecurity ================ MajorSecurity is a German pentest and security research project which focuses on web application security. You can find more Information on the MajorSecurity Project at http://www.majorsecurity.de/pentest.php
