SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   XOOPS Vendors:   Xoops.sourceforge.net
XOOPS Portal Input Validation Flaw in IMG Tags Lets Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1005281
SecurityTracker URL:  http://securitytracker.com/id/1005281
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Sep 24 2002
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): RC3.0.4
Description:   An input validation vulnerability was reported in the XOOPS portal software. A remote user can cause arbitrary javascript to be executed on an XOOPS user's computer.

It is reported that a remote user can insert javascript in a news post, as shown:

<IMG SRC="javascript:[javascript]">

When the news post is viewed by a target user, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running XOOPS and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

The vendor has reportedly been notified.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with an XOOPS site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry. The vendor is reportedly planning to fix the flaw in a future release.

The author of the report suggests disabling HTML in each message as a workaround.

Vendor URL:  www.xoops.org/modules/news/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
(Vendor Issues Fix) Re: XOOPS Portal Input Validation Flaw in IMG Tags Lets Remote Users Conduct Cross-Site Scripting Attacks
The vendor has issued a fix.



 Source Message Contents

Subject:  Xoops RC3 script injection vulnerability



--------------------------------------------
| Xoops RC3 script injection vulnerability |
--------------------------------------------


PROGRAM: Xoops
VENDOR: http://www.xoops.org/
VULNERABLE VERSIONS: RC3.0.4,possibly previous versions
IMMUNE VERSIONS: no immune current versions
SEVERITY: high


Product Description
=================== 
"XOOPS is a dynamic OO (Object Oriented) based open source portal script written in PHP. XOOPS is the ideal tool for developing small
 to large dynamic community websites, intra company portals, corporate portals, weblogs and much more." dixit vendor website.
It can be found at http://www.xoops.org


Tested version
==============
Xoops RC3.0.4, current version (maybe previous versions are also vulnerables).


Description
============ 
The problem appears when a user post a news, a vulnerability exists in Xoops RC3 that allow a typical IMG attack against visitors
 :

<IMG SRC="javascript:[javascript]"> 


The problem
=========== 
A badly disposed member can propose a news containing code (for une news containing code sample of a new vulnerability for example)
 and if webmasters or moderators don't take care, they will approve the news.


Vendor status
=============
I wanted to inform someone from Xoops.org but the website wasn't available, so I informed the French team. They weren't aware of this
 problem so they transmitted it to the Dev Team. The Dev Team had already located the vulnerability which is not specific to Xoops
 but with much of scripts.
In future version, a new filter will be inserted in the textsanitizer to avoid even more this risk.


Solution
========
There's no secure release of Xoops, so the unique solution is, at this moment to disable Html in each post, to avoid the problem.


Links
=====
Vendor: http://www.xoops.org
Vendor French team: http://www.frxoops.org

This vulnerability's orginal paper can be found here: http://www.echu.org/modules/news/article.php?storyid=95


------------------------------
David Suzanne (aka dAs)
das@echu.org
http://www.echu.org



Get your free encrypted email at https://www.hushmail.com

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC