Easy File Sharing Persistent Cross Site Scripting

2014.07.27
Credit: Joseph Giron
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

I saw a posting a month or 2 ago for a BOF in an FTP server belonging to EFS Software here: http://www.securityfocus.com/bid/19243 At first there was no additional details provided and I hunted up and down before finding it after some fuzzing (stack smash in password). While on the hunt, I found one not listed. Easy file sharing web server - XSS in forum messages. Its persistent XSS. Don't see that much these days. The BB code (which looks suspiciously like it was lifted from PHPBB) fails to filter javascript and other html attributes from the posts. Example exploit in test message: [IMG]testing123" onmouseover="alert('10000')">[/IMG] Peeking inside with IDA, we see why: .data:0055D61C ; char aImgSrcSBorde_0[] .data:0055D61C aImgSrcSBorde_0 db '<img src=%s border=0>',0 ; DATA XREF: sub_41B930+49F .data:0055D61C ; sub_41FC10+6B2 ... Following the subroutine, there's no real formatting or escaping done. I mean the forum posting does attempt some form of filtering, but its bypassed easily.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top