bugtraq - Re: [SePro Bugtraq] WBB Portal - JGS-Portal <= 3.0.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050519115711.30613.qmail@www.securityfocus.com>
Date: 19 May 2005 11:57:11 -0000
From: <deluxe@...urity-project.org>
To: bugtraq@...urityfocus.com
Subject: Re: [SePro Bugtraq] WBB Portal - JGS-Portal <= 3.0.2 - Multiple
    Vulnerabilities (09.05.05)


In-Reply-To: <200505172151.j4HLpThM004829@...us.mitre.org>

>>Cross Site Scripting:
>>-------------------------
>>You can abuse the SQL-Injections for XSS attacks.
>
>Does this occur because the XSS-style attacks are being injected into
>SQL queries, which then generate errors because the queries are
>malformed, and then PHP blindly reflects the malformed query back to
>the user without quoting XSS-relevant characters?  That would seem to
>be more of a problem with the application's runtime environment
>(i.e. PHP) than JGS-Portal itself.

Try the following link:
/jgs_portal_statistik.php?meinaction=mitglieder&month=1&year=1&lt;script&gt;alert(document.cookie);&lt;/script&gt;

JGS-Portal doesn't report an error and the year parameter is passed unfiltered. This is definitively the problem of JGS-Portal.


If a SQL-error occurs and the error message contains Cross Site Scripting code, than you're completely right.


Regards,
deluxe