ASPScriptz Guest Book submit.asp 多个跨站脚本攻击(XSS)漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1194648 漏洞类型 跨站脚本
发布时间 2006-06-07 更新时间 2006-10-30
CVE编号 CVE-2006-2882 CNNVD-ID CNNVD-200606-169
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://cxsecurity.com/issue/WLB-2006060062
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200606-169
|漏洞详情
ASPScriptzGuestBook2.0及更早版本中的submit.asp存在多个跨站脚本攻击(XSS)漏洞,远程攻击者可通过(1)GBOOK_UNAME,(2)GBOOK_EMAIL,(3)GBOOK_CITY,(4)GBOOK_COU,(5)GBOOK_WWW和(6)GBOOK_MESS表单字段来注入任意webJ脚本或HTML。
|漏洞EXP
------------------------------------------------------------------

- ASPScriptz Guest Book 2.0 Remote XSS -

-= http://colander.altervista.org/advisory/ASzGB.txt =-

------------------------------------------------------------------

-= ASPScriptz Guest Book 2.0 =-

Omnipresent

May 18, 2006

Vunerability(s):

----------------

XSS Attack

Product:

--------

ASPScriptz Guest Book 2.0

Vendor:

--------

http://www.aspscriptz.com

Description of product:

-----------------------

Guesbook is a free open source guestbook.Simply download it and unzip it and upload it into the root directory of your

server.It is working now.Smilies support it also added in this version.Admin can disable or enable HTML support.Admin

section is also included.

Vulnerability / Exploit:

------------------------

From line 109 to line 113, there are the vulnerable code:

[...]

GBOOK_UNAME	=	REQUEST.FORM("GBOOK_UNAME")

GBOOK_EMAIL	=	REQUEST.FORM("GBOOK_EMAIL")

GBOOK_CITY	=	REQUEST.FORM("GBOOK_CITY")

GBOOK_COU	=	REQUEST.FORM("GBOOK_COU")

GBOOK_WWW	=	REQUEST.FORM("GBOOK_WWW")

[...]

As you can see, the variables:

GBOOK_UNAME

GBOOK_CITY

GBOOK_COU

are not properly sanitized before being used, so a remote attacker can inject arbitrary HTML code.

So, the programmer for delete the bug can modify the source code with a simple replace().

PoC / Proof of Concept of SQL Injection:

----------------------------------------

Not very hard.. :D Just put <script>alert("XSS")</script> in the Name, City and Country fields.

Vendor Status

-------------

[2006/06/05] Vendor Informed!

Credits:

--------

omnipresent

omnipresent (at) email (dot) it [email concealed]
|参考资料

来源:BID
名称:18285
链接:http://www.securityfocus.com/bid/18285
来源:BUGTRAQ
名称:20060605ASPScriptzGuestBook2.0XSS
链接:http://www.securityfocus.com/archive/1/archive/1/436028/100/0/threaded
来源:VUPEN
名称:ADV-2006-2150
链接:http://www.frsirt.com/english/advisories/2006/2150
来源:SECUNIA
名称:20416
链接:http://secunia.com/advisories/20416
来源:MISC
链接:http://colander.altervista.org/advisory/ASzGB.txt
来源:XF
名称:aspscriptzgb-submit-xss(26944)
链接:http://xforce.iss.net/xforce/xfdb/26944
来源:SREASON
名称:1056
链接:http://securityreason.com/securityalert/1056