PHP Live!多个跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1192341 漏洞类型 跨站脚本
发布时间 2006-12-27 更新时间 2007-01-02
CVE编号 CVE-2006-6769 CNNVD-ID CNNVD-200612-567
漏洞平台 N/A CVSS评分 6.8
|漏洞来源
https://cxsecurity.com/issue/WLB-2006120136
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200612-567
|漏洞详情
PHPLive!是一种构架于PHP、MySQL之上的开源软件,可为企业用户提供实时交谈服务。PHPLive!的管理面板和对话系统中存在多个跨站脚本攻击漏洞。具体来说,setup/transcripts.php文件没有正确过滤对search_string参数的输入,message_box.php文件没有正确过滤对deptid和x参数的输入,index.php文件没有正确对l参数点输入。远程攻击者可以利用这些漏洞在用户浏览器会话中执行任意HTML和脚本代码。
|漏洞EXP
PHP Live! (© OSI Codes Inc.) enables live help and live customer support communication directly from your website. With PHP Live!, you can provide one-on-one chat assistance in real-time, answer visitor questions and add that extra human touch to your website. The application if full of xss holes inside the Admin Panel and chat system its self. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PHP Live! 3.2.2 Multiple Cross-Site Scripting Vulnerabilities

Hackers Center Security Group (http://www.hackerscenter.com)

Credit: Doz

Risk: Medium to High

Vendor: www.phplivesupport.com/

Class: Cross-Site Scripting

Remote: Yes

Local: 	Yes

Free Trial: www.phplivesupport.com/trial.php

Versions: 3.2.2 & older versions maybe effected.

Exploit: An attacker can exploit these issues via a web client.

XSS example:

Local:

/transcripts.php?action=view&deptid=1&userid=0&search_string=[XSS]

or

http://PHP Live Site.com/index.php?l=[XSS]

or

http://PHP Live Site.com/phplive/index.php (login XSS)

Remote:

/phplive/message_box.php?theme=&l=ezpub&x=1&deptid=[XSS]

or

/phplive/message_box.php?theme=&l=admin&x=[XSS]

Solution: Filter out characters that invite XSS attacks.
|参考资料

来源:BID
名称:21737
链接:http://www.securityfocus.com/bid/21737
来源:BUGTRAQ
名称:20061225PHPLive!3.2.2MultipleCross-SiteScriptingVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/455269/100/0/threaded
来源:MISC
链接:http://www.hackerscenter.com/archive/view.asp?id=26833
来源:SECUNIA
名称:23488
链接:http://secunia.com/advisories/23488
来源:SREASON
名称:2068
链接:http://securityreason.com/securityalert/2068