XOOPS Portal Input Validation Flaw in IMG Tags Lets Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID: 1005281|
SecurityTracker URL: http://securitytracker.com/id/1005281
(Links to External Site)
Date: Sep 24 2002
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network|
Vendor Confirmed: Yes Exploit Included: Yes |
When the news post is viewed by a target user, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running XOOPS and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
The vendor has reportedly been notified.
A remote user can access the target user's cookies (including authentication cookies), if any, associated with an XOOPS site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.|
No solution was available at the time of this entry. The vendor is reportedly planning to fix the flaw in a future release.|
The author of the report suggests disabling HTML in each message as a workaround.
Vendor URL: www.xoops.org/modules/news/ (Links to External Site)
Input validation error|
|Underlying OS: Linux (Any), UNIX (Any), Windows (Any)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: Xoops RC3 script injection vulnerability|
| Xoops RC3 script injection vulnerability |
VULNERABLE VERSIONS: RC3.0.4,possibly previous versions
IMMUNE VERSIONS: no immune current versions
"XOOPS is a dynamic OO (Object Oriented) based open source portal script written in PHP. XOOPS is the ideal tool for developing small
to large dynamic community websites, intra company portals, corporate portals, weblogs and much more." dixit vendor website.
It can be found at http://www.xoops.org
Xoops RC3.0.4, current version (maybe previous versions are also vulnerables).
The problem appears when a user post a news, a vulnerability exists in Xoops RC3 that allow a typical IMG attack against visitors
A badly disposed member can propose a news containing code (for une news containing code sample of a new vulnerability for example)
and if webmasters or moderators don't take care, they will approve the news.
I wanted to inform someone from Xoops.org but the website wasn't available, so I informed the French team. They weren't aware of this
problem so they transmitted it to the Dev Team. The Dev Team had already located the vulnerability which is not specific to Xoops
but with much of scripts.
In future version, a new filter will be inserted in the textsanitizer to avoid even more this risk.
There's no secure release of Xoops, so the unique solution is, at this moment to disable Html in each post, to avoid the problem.
Vendor French team: http://www.frxoops.org
This vulnerability's orginal paper can be found here: http://www.echu.org/modules/news/article.php?storyid=95
David Suzanne (aka dAs)
Get your free encrypted email at https://www.hushmail.com