Arcadwy Arcade Script (username) Static XSS Vulnerability

2009.04.04

Credit: Anarchy Angel

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2009-1228

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

#################################\
# Information          
# Script                 : Arcadwy Arcade Script CMS             
# Buy/Download   : http://arcadwy.com/                           
# Vulnerability      : Static XSS                                          
# Discovered by    : Anarchy Angel                                    
# Contact              : anarchy[dot]ang31 [@] gmail           
# Website              : http://hha.zapto.org                           
# Greets                : Xteaphn, lun0s, BSDgurl, progenic.  
\#################################/

[!] EXPLOIT
    1) Go to http://site.com/register.php
    2) In username field input XSS payload
    3) Fill in the rest of the fields and submit.
    4) Activate account!

Every time the accounts username is shown on the site the XSS will run.
Usernames show in comments, game scores, and so on.

[!] FIX: Sanitize all input from the registers page form.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Arcadwy Arcade Script (username) Static XSS Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.