phpSysInfo Index.php 跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1189635 漏洞类型 跨站脚本
发布时间 2007-07-27 更新时间 2007-08-28
CVE编号 CVE-2007-4048 CNNVD-ID CNNVD-200707-522
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://www.securityfocus.com/bid/25090
https://cxsecurity.com/issue/WLB-2007080019
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200707-522
|漏洞详情
phpSysInfo2.5.4-dev版本及其早期版本的index.php中存在跨站脚本攻击漏洞。远程攻击者可以借助PATH_INFO,注入任意web脚本或HTML。
|漏洞EXP
 [HSC] PHPSysInfo Index.php Cross Site Scripting

PhpSysInfo is a PHP script that displays information about the host being accessed.
An attacker may leverage this issue to have arbitrary script code execute
in the browser of an unsuspecting user in the context of the affected site.
This may help the attacker steal cookie-based authentication credentials and
launch other attacks. A successful exploit could allow an attacker to compromise
the application, access or modify data, or exploit vulnerabilities in the
underlying database implementation.

Hackers Center Security Group (http://www.hackerscenter.com)
Credit: Doz

Class: Input Validation Error

Remote: Yes
Local: N/A

Product: PHPSysInfo
Version: phpSysInfo-2.5.4 *Other version are be vulrnable.
Vendor: http://phpsysinfo.sourceforge.net/

Exploit is not needed, Attackers can exploit these issues via a web client.

Exploit: http://www.Site.com/phpsysinfo-path/index.php/XSS

Only becoming a hacker you can stop a hacker. Were can you learn with out having
to pay thousands!- http://kit.hackerscenter.com - The most comprehensive security
pack you will ever find on the net!
|受影响的产品
phpSysInfo phpSysInfo 2.5.3 PHPGroupWare PHPGroupWare 0.9.16.011
|参考资料

来源:BUGTRAQ
名称:20070725PHPSysInfoIndex.phpCrossSiteScripting
链接:http://www.securityfocus.com/archive/1/archive/1/474756/100/0/threaded
来源:SECUNIA
名称:26248
链接:http://secunia.com/advisories/26248
来源:OSVDB
名称:36601
链接:http://osvdb.org/36601
来源:BID
名称:25090
链接:http://www.securityfocus.com/bid/25090
来源:sourceforge.net
链接:http://sourceforge.net/project/shownotes.php?release_id=532143
来源:SREASON
名称:2952
链接:http://securityreason.com/securityalert/2952
来源:SECUNIA
名称:26473
链接:http://secunia.com/advisories/26473
来源:download.phpgroupware.org
链接:http://download.phpgroupware.org/