[*Yawn* another vulnerability in a PHP-based portal system. I don't really know how popular these portals are in India, so am looking for a mechanism that would allow me to send out, say, one advisory a week summarising the systems and the types of vulnerabilities found in them -- Raju] ]
This is an RFC 1153 digest. (1 message) ---------------------------------------------------------------------- Message-ID: <006b01c2c4d7$8811dd00$0300a8c0@goliath> From: =?iso-8859-1?Q?Gr=E9gory_Le_Bras_|_Security_Corporation?= <[EMAIL PROTECTED]> Sender: [EMAIL PROTECTED] To: <[EMAIL PROTECTED]> Subject: [Full-Disclosure] [SCSA-003] Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan Date: Sun, 26 Jan 2003 02:09:09 +0100 .: Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan :. ________________________________________________________________________ Security Corporation Security Advisory [SCSA-003] ________________________________________________________________________ PROGRAM: Nuked-Klan HOMEPAGE: http://www.nuked-klan.org VULNERABLE VERSIONS: beta 1.2 and prior ________________________________________________________________________ DESCRIPTION ________________________________________________________________________ Nuked Klan is a PHP Gateway for "clans". (direct quote from Nuked Klan website) DETAILS & EXPLOITS ________________________________________________________________________ Many Cross-Site Scripting vulnerabilities have been found in Nuked Klan which allow attackers to inject script codes into the page and use them on clients browser as if they were provided by the site. These Cross-Site Scripting vulnerabilities are found in the following modules : Guestbook, Forum, Shoutbox. An attacker can input specially crafted links and/or other malicious scripts. Guestbook ________________________________________________________________________ A vulnerability was discovered in the page for posting messages, at this adress : http://[target]/index.php?file=Guestbook&req=post_book The vulnerability is at the level of the interpretation of the "Author" field. Indeed, the insertion of a hostile code script in this field makes it possible to a malicious user to carry out this script on the navigator of the visitors. The hostile code could be : [script]alert("Cookie="+document.cookie)[/script] (open a window with the cookie of the visitor.) (replace [] by <>) Forum ________________________________________________________________________ A vulnerability was discovered in the page for posting new messages in the forum, at this adress : http://[target]/index.php?file=Forum&op=post_screen&forum_id=0 The vulnerability is at the level of the interpretation of the "Titre" and "Pseudo" field. Indeed, the insertion of a hostile code script in this field makes it possible to a malicious user to carry out this script on the navigator of the visitors. The hostile code could be : [script]alert("Cookie="+document.cookie)[/script] (open a window with the cookie of the visitor.) (replace [] by <>) Shoutbox ________________________________________________________________________ A vulnerability was discovered in the page for posting messages in "La Tribune Libre". Indeed, the insertion of a hostile code script in this field makes it possible to a malicious user to carry out this script on the navigator of the visitors. The hostile code could be : [script]alert("Cookie="+document.cookie)[/script] (open a window with the cookie of the visitor.) (replace [] by <>) -------Vulnerable line in submit.php-------- $shout = str_replace("|","",$SB_text); -------------------------------------------- Possible solutions: modify the code in order to analyze the whole of the text sent by the user and to replace the hostile elements. ---------------Code example----------------- <? $SB_text = str_replace("<", "[", $SB_text); $SB_text = str_replace(">", "]", $SB_text); $SB_text = htmlentities($SB_text); $shout = str_replace("|","",$SB_text); ?> -------------------------------------------- SOLUTIONS ________________________________________________________________________ Upgrade your version to beta 1.3 Upgrade Guestbook with the appropriate patch : http://tomysnockers.net/download/Guestbook.rar Upgrade Shoutbox with the appropriate patch : http://www.nuked-klan.org/files/Shoutbox_13.zip VENDOR STATUS ________________________________________________________________________ The vendor has reportedly been notified. LINKS ________________________________________________________________________ http://www.security-corp.org/index.php?ink=4-15-1 ----------------------------------------------------------------- Gr�gory Le Bras aka GaLiaRePt | http://www.Security-Corp.org ----------------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ------------------------------ End of this Digest ****************** -- Raj Mathur [EMAIL PROTECTED] http://kandalaya.org/ It is the mind that moves ================================================ To unsubscribe, send email to [EMAIL PROTECTED] with unsubscribe in subject header. Check archives at http://www.mail-archive.com/ilugd%40wpaa.org
