SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Netquery Vendors:   Virtual Edge
Netquery Input Validation Flaw in 'nquser.php' Script in 'User-Agent' Parameter Permits Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1017147
SecurityTracker URL:  http://securitytracker.com/id/1017147
CVE Reference:   CVE-2006-5661   (Links to External Site)
Updated:  Nov 10 2006
Original Entry Date:  Nov 1 2006
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   Tal Argoni (LegendaryZion) reported a vulnerability in Netquery. A remote user can conduct cross-site scripting attacks.

The 'nquser.php' script does not properly filter HTML code from user-supplied input in the HTTP Header 'User-Agent' value before displaying the input. A remote user can create a specially crafted request that, when submitted by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Netquery software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit header excerpt is provided:

GET http://[target]/netquery/nquser.php HTTP/1.0
User-Agent: <script>alert('User-Agent:')</script>

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Netquery software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has issued a fix. For versions downloaded on or prior to November 10, 2006, a patch is also available.
Vendor URL:  www.virtech.org/tools/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Cross Site Scripting (XSS) Vulnerability in Netquery by



Issue: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
Discovered Date: 04/10/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.virtech.org

Details:

VIRtechs Netquery system is prone to a Cross Site Scripting Vulnerability.
The vulnerability exists in "nquser.php" file, caused by the lack of Input Validation/Filtering
of quotation and HTML characters in the header parameter "User-Agent:".

Part of the http header:

GET http://target/netquery/nquser.php HTTP/1.0
User-Agent: <script>alert('User-Agent:')</script>
...


After send the crafted http header, nquser.php prints the following HTML code:
------------------------------------------------------------------------------------------------------------------
...
User Agent : <script>alert('User-Agent:')</script><br />
...



Successful exploitation may allow execution of script code. This could also be exploited to spoof the entire website's content,
create fake login menu's for all the platform's users, commit Denial Of Service attacks and more...

Proof Of Concept:

GET http://virtech.org/e107/e107_plugins/netquery/nquser.php HTTP/1.0
Accept: */*
Referer: http://virtech.org/tools/
Accept-Language: en-us
Pragma: no-cache
User-Agent: <script>alert()</script>
Host: virtech.org
Proxy-Connection: Keep-Alive
Cookie: e107_tdOffset=32630; e107_tdSetTime=1159974893; e107_tzOffset=420
Content-length: 0

Vulnerable systems:
e107 Edition
Postnuke Edition
Xaraya Edition
Xoops Edition

Not vulnerable systems:
Standalone Edition
Fusion Edition


Thanks,
Tal Argoni, CEH
www.zion-security.com
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC