lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 21 Jan 2007 10:24:50 -0000
Subject: PHP Link Directory XSS Vulnerability version <= 3.0.6

                           Smilehouse Oy
                      -= Security Advisory =-

     Advisory: PHP Link Directory XSS Vulnerability
 Release Date: 2007/01/21
Last Modified: 2007/01/21
      Authors: Jussi Vuokko, CISSP []
               Henri Lindberg, Associate of (ISC) []

  Application: PHP Link Directory <= 3.0.6
     Severity: XSS vulnerability within the administration
               interface allow Cross Site Scripting attacks against
               the link directory admin
         Risk: Critical
Vendor Status: Vendor has released an updated version


   Quote from
   "phpLD is now the most widely used directory script on the
    internet. Our customers having tested the script on over 10,000
    websites has allowed us to bring you a script that works in
    virtually all PHP hosting environments. Put simply, it just

   During an quick audit of PHP Link Directory it was discovered that
   XSS vulnerability exist in the administration area. Thus, it is
   possible for an attacker, tricking an admin, to validate submitted
   link, and to perform any administrative actions in the link
   directory. These include e.g. posting entries or adding additional
   admin users.


   PHP Link Directory failed to sanitize user input correctly on the
   administration page. User can submit link (URL) containing
   javascript which will be executed on the administration page after
   selecting "Validate links" -> "Start". This is due to the URL being
   saved without HTML encoding.

Proof of Concept:

   Example of an URL:"><script>;alert('url');</script>

   As "Validate links" -> "Start" is selected on the administration
   page the javascript alert will pop up.


   Update to PHP Link Directory > 3.0.6.

Disclosure Timeline:

   30. October 2006 - Contacted PHP Link Directory developers by email
   1. December 2006 - Vender released an updated version
   21. January 2007 - Advisory was released

Copyright 2007 Smilehouse Oy. All rights reserved.

Powered by blists - more mailing lists