# Exploit Title: lifetype 1.2.10 http referer XSS(stored)
# Date: 11-1-2010
# Author: Saif El-Sherei
# Software Link: http://lifetype.net/page/downloads
# Version: 1.2.10
# Tested on: firefox 3.0.15
failure to sanitize the http referer header in index.php results in a cross
site scripting attack against admins or any user able to view blog
statistics. an attacker could use an intercepting proxy or manual requests
to perform this attack, the referer is recorder into the database when
visiting any section in the index.php (albums, archives,etc....), a user
with only the privilege to login could perform this attack, the issue
affects all browsers.
POC:
injection in referer HTTP header
referer:
http://127.0.0.1/lifetype-1.2.10/index.php?op=Template&blogId=1&show=archives
"><script>alert('XSS')</script>
timeline:
vulnerability dicovered: 11-1-2011
vendor notified: 11-1-2011
Regards,
Saif El-Sherei
OSCP