SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   NuKed-KlaN Vendors:   nuked-klan.org
NuKed-KlaN PHP Gateway Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1005993
SecurityTracker URL:  http://securitytracker.com/id/1005993
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 27 2003
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): beta 1.2 and prior versions
Description:   An input validation vulnerability was reported in the NuKed-KlaN PHP-based forum software. A remote user can conduct cross-site scripting attacks against web forum users.

Security Corporation released an advisory warning of flaws in the Guestbook, Forum, and Shoutbox modules.

In the Guestbook module, a remote user can insert specially crafted text into the "author" field so that when a target user views the Guestbook entry, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running NuKed-KlaN and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

In the Forum, the vulnerable fields are the "Titre" and "Pseudo" fields.

In the Shoutbox module, the submit.php script presents the vulnerable "La Tribune Libre" field.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running NuKed-KlaN, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has reportedly released a fixed version (beta 1.3), available at:

http://www.nuked-klan.org/

Vendor URL:  www.nuked-klan.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-Disclosure] [SCSA-003] Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan


.: Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan :.

________________________________________________________________________

Security Corporation Security Advisory [SCSA-003]
________________________________________________________________________

PROGRAM: Nuked-Klan
HOMEPAGE: http://www.nuked-klan.org
VULNERABLE VERSIONS: beta 1.2 and prior
________________________________________________________________________


DESCRIPTION
________________________________________________________________________

Nuked Klan is a PHP Gateway for "clans". (direct quote from Nuked Klan
website)


DETAILS & EXPLOITS
________________________________________________________________________

Many Cross-Site Scripting vulnerabilities have been found in Nuked Klan
which allow attackers to inject script codes into the page and use them on
clients browser as if they were provided by the site.


These Cross-Site Scripting vulnerabilities are found in the following
modules : Guestbook, Forum, Shoutbox.

An attacker can input specially crafted links and/or other malicious
scripts.


Guestbook
________________________________________________________________________

A vulnerability was discovered in the page for posting messages, at this
adress :

http://[target]/index.php?file=Guestbook&req=post_book


The vulnerability is at the level of the interpretation of the "Author"
field.

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator of
the visitors.


The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)



Forum
________________________________________________________________________

A vulnerability was discovered in the page for posting new messages in the
forum, at this adress :

http://[target]/index.php?file=Forum&op=post_screen&forum_id=0

The vulnerability is at the level of the interpretation of the "Titre" and
"Pseudo" field.

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator of
the visitors.

The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)



Shoutbox
________________________________________________________________________

A vulnerability was discovered in the page for posting messages in "La
Tribune Libre".

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator of
the visitors.

The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)


-------Vulnerable line in submit.php--------

$shout = str_replace("|","",$SB_text);

--------------------------------------------


Possible solutions: modify the code in order to analyze the whole of the
text sent by the user and to replace the hostile elements.


---------------Code example-----------------
<?
$SB_text = str_replace("<", "[", $SB_text);
$SB_text = str_replace(">", "]", $SB_text);
$SB_text = htmlentities($SB_text);
$shout = str_replace("|","",$SB_text);
?>
--------------------------------------------


SOLUTIONS
________________________________________________________________________

Upgrade your version to beta 1.3


Upgrade Guestbook with the appropriate patch :
http://tomysnockers.net/download/Guestbook.rar

Upgrade Shoutbox with the appropriate patch :
http://www.nuked-klan.org/files/Shoutbox_13.zip



VENDOR STATUS
________________________________________________________________________

The vendor has reportedly been notified.


LINKS
________________________________________________________________________

http://www.security-corp.org/index.php?ink=4-15-1




-----------------------------------------------------------------
-----------------------------------------------------------------



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC