bugtraq - Cross-site Scripting and CSRF in TorrentTrader Classic v1.08

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 3 Mar 2008 22:09:06 +0200
From: "Valery Marchuk" <tecklord@...uritylab.ru>
To: <full-disclosure@...ts.grok.org.uk>, <bugtraq@...urityfocus.com>
Subject: Cross-site Scripting and CSRF in TorrentTrader Classic v1.08

Cross-site Scripting and CSRF in TorrentTrader Classic v1.08

Application: TorrentTrader Classic v1.08, possible other versions.

Vendor URL: 
http://sourceforge.net/project/showfiles.php?group_id=98584&package_id=1809271.

1. Input passed to the msg property of account-inbox.php is not properly
sanitized before being displayed to the user. A malicious authenticated user
can execute arbitrary HTML and scripting code in a user's browser session in
context of an affected web site.
Example:
http://[host]/account-inbox.php?msg=<script>alert(document.cookie)</script>&receiver=<username>

2. The application allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the request.  A malicious
person can perform a CSRF attack.
Example:
http://[host]/account-inbox.php?msg=<message>&receiver=<username>

Vulnerability #1 was discovered by Dominus.
Original URL: http://www.securitylab.ru/vulnerability/347887.php

BR,
Valery Marchuk
www.SecurityLab.ru