myPHPscripts Login Session 'login.php'多个跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1117090 漏洞类型 跨站脚本
发布时间 2008-12-19 更新时间 2009-01-29
CVE编号 CVE-2008-5854 CNNVD-ID CNNVD-200901-043
漏洞平台 PHP CVSS评分 4.3
|漏洞来源
https://www.exploit-db.com/exploits/7526
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-043
|漏洞详情
myPHPscriptsLoginSession中的脚本login.php存在多个跨站脚本攻击漏洞。远程攻击者可以借助ls_register操作中的(1)ls_user和(2)ls_email参数(又称用户格式),注入任意的web脚本或HTML。
|漏洞EXP
[START]

####################################################################################################################
[0x01] Informations:

Script         : myPHPscripts Login Session 2.0
Download       : http://www.hotscripts.com/jump.php?listing_id=69881&jump_type=1
Vulnerability  : XSS / Database Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [XSS]
######

Bugged file is: /[path]/login.php

[CODE]

if ($u_invalid == 1) { $errors[] = "User <strong>$user</strong> is invalid. 3-15 alphanumeric characters required."; }

[/CODE]

If the username that we typed in the register form is invalid, it will directly appear in the html code.
So we just have to put a js code, like an alert, and we will get a XSS.

[!] FIX: Filter or validate $user before printing it in html code.


[!] EXPLOIT: 
             1) Go at: /[path]/login.php?ls_register
             2) In User form put a js code. (ex: <script>alert("XSS")</script>)
             3) Field the other forms, and press register button.

####################################################################################################################
[0x03] Bug: [Database Disclosure]
######

Bugged file is: /[path]/login.php

[CODE]

	if (empty($errors)) {
		$newline = $records++;
		$e_email = base64_encode($email);
		$data = "$newline||$user||$e_email||$pass\n";
		$fh = fopen($users, 'a') or die("Can't open user database.");
		fwrite($fh, $data);
		fclose($fh);
?>

[/CODE]

This cms uses a flat database, a .txt file where it stores usernames,passwords and emails of the registered
users.

[!] FIX: Don't use this kind of authentication :)


[!] EXPLOIT: /[path]/users.txt

             Informations are printed in this way:
             0||admin||b3NpcnlzQGxpdmUuaXQ=||6e1459df459890dfd8b4c3687c18abba
             1||cazzone||bG9sQGxvbC5pdA==||b7dba5a1bc3605a87b59ac8147512c97

             user_number||username||email(base64 encrypted)||password(md5 encrypted)

####################################################################################################################

[/END]

# milw0rm.com [2008-12-19]
|参考资料

来源:XF
名称:loginsession-login-xss(47501)
链接:http://xforce.iss.net/xforce/xfdb/47501
来源:BID
名称:32941
链接:http://www.securityfocus.com/bid/32941
来源:MILW0RM
名称:7526
链接:http://www.milw0rm.com/exploits/7526
来源:SREASON
名称:4873
链接:http://securityreason.com/securityalert/4873
来源:SECUNIA
名称:33253
链接:http://secunia.com/advisories/33253