PHPCounter Input Validation Hole in EpochPrefix Parameter Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1014478 |
|
SecurityTracker URL: http://securitytracker.com/id/1014478
|
|
CVE Reference:
CVE-2005-2288, CVE-2005-2289
(Links to External Site)
|
Updated: Jun 24 2008
|
Original Entry Date: Jul 14 2005
|
Impact:
Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 7.2
|
Description:
An input validation vulnerability was reported in PHPCounter. A remote user can conduct cross-site scripting attacks. A remote user can also determine the installation path.
The script does not properly filter HTML code from user-supplied input in the EpochPrefix parameter. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the PHPCounter software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit URL is provided:
http://[target]/CounterDirectory/index.php?Plugin=All%20Hits&EpochPrefix="></a></div><script>a=/XSS/%0aalert(a.sour
A remote user can supply the following type of URL to cause the system to disclose the installation path:
http://[target]/CounterPath/prelims.php
priestmaster reported this vulnerability.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the PHPCounter software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.ekstreme.com/phplabs/phpcounter.php (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Subject: Path Disclosure and XSS problem in PHP Counter 7.2
|
------------------------------------------------------------------------
This mail message contains standard MIME attachments. If you see this
note, your e-mail program does not support MIME. You may need a MIME-
compliant mail reader to read any non-text attachments in this message.
------------------------------------------------------------------------
--==IMail_v8.1==
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hi,
I found two vulnerabillities in PHP Counter 7.2
PHP Counter Vendor:
http://www.ekstreme.com/phplabs/phpcounter.php
First an XSS problem (file phpcounterxss.txt)
Second a Path disclosure vulnerabillity (file phpcounterdir.txt).
greets,
priestmaster
Mail: <priest@priestmaster.org>
URL: http://www.priestmaster.org
--==IMail_v8.1==
Content-Type: text/plain; name="phpcountxss.txt"
Content-Transfer-Encoding: 7bit
----------------------------------------------------------
---- Team priestmasters PHP Counter 7.2 XSS Advisorie ----
----------------------------------------------------------
PHP Counter Vendor:
http://www.ekstreme.com/phplabs/phpcounter.php
PHP Counter 7.2 does not filter "<>" tags in EpochPrefix
parameter. Cross site scripting and HTML injection is possible.
Exploitation:
http://www.yourwebsite.org/CounterDirectory/index.php?Plugin=All%20Hits&EpochPrefix="></a></div><script>a=/XSS/%0aalert(a.source)</script>
The injected script is called multiple times.
XSS is hard to do because ' and " are filtered.
greets,
priestmaster
URL: http://www.priestmaster.org
Email: priest@priestmaster.org
--==IMail_v8.1==
Content-Type: text/plain; name="phpcountdir.txt"
Content-Transfer-Encoding: 7bit
------------------------------------------------------------
-------- Team priestasters PHP Counter 7.2 Advisorie -------
---------------- Path disclosure vulnerabillity ------------
------------------------------------------------------------
PHP Counter Vendor:
http://www.ekstreme.com/phplabs/phpcounter.php
A Path disclosure vuln exist in prelims.php
Exploitation is simple:
http://www.yoursite.com/CounterPath/prelims.php
Output look like this:
Fatal error: Call to undefined function: getdawn()
in /home/.sites/165/site223/web/Counter/prelims.php on line 63
That's all :-)
priestmaster
--==IMail_v8.1==--
|
|
