Olate Download 3.4.2~modules/core/fldm.php~comments tag [url] XSS

2007.08.31
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

VISITE ORIGINAL ADVISORY FOR MORE DETAILS http://myimei.com/security/2007-08-22/olate-download-342modulescorefldmp hpcomments-tag-url-xss.html VISITE ORIGINAL ADVISORY FOR MORE DETAILS ????????????-Summary??????????- Software: Olate Download Sowtware's Web Site: http://www.olate.co.uk/ Versions: 3.4.2 Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: imei addmimistrator Risk Level: Middel VISITE ORIGINAL ADVISORY FOR MORE DETAILS http://myimei.com/security/2007-08-22/olate-download-342modulescorefldmp hpcomments-tag-url-xss.html VISITE ORIGINAL ADVISORY FOR MORE DETAILS ----- From http://myimei.com/ --------------------------------- Olate download is prone to Cross site scripting, cause of simple code replacing for comments in mentioned file bug is in line about 231, that programmers simply replaced some patterns with some equivalents. Usually, phrasing codes are a complicated process especially if there was more codes and more cases. codes embedded into HTML tags, are more dangerous. I’m approximately sure that there is no reasonable solution but using Regular Expression for this propose. In this case, 3 other codes phrased using str_replace() function that is very weaker than preg_replace(). Look at the related code: $comment[’comment’] = preg_replace(’/\[url\](.*)\[\/url\]/si’,’$1‘,$comment[’comment’]); Even in this using of preg_replace, using a weak pattern (.*) results to a simple XSS bug. ————–Exploit———————- comment this at a desired file detail: [url]javascript:alert(1)[/url] ———–Solution——————— Not any updates available~ ————–Credit———————– Discovered by: imei addmimistrator addmimistrator(4}gmail(O}com ------------------------ End------------------ -- imei Addmimistrator Visit my SeQrity Homepage at: http://myimei.com/security


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top