bugtraq - Mitridat Form Processor Pro XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 25 Jul 2007 10:13:25 -0700
From: "Charles Kim" <charleskim.us@...il.com>
To: bugtraq@...urityfocus.com
Subject: Mitridat Form Processor Pro XSS

Greetings,

I have discovered cross-site scripting vulnerability in Mitridat's
Form Processor Pro.

http://www.mitridat.com/
http://www.mitridat.com/products-form-processor-pro.html

Form Mail: Email Form Processor Pro™ - process all forms on your website
Form Mail: Email Form Processor Pro is the most powerful script to
process forms on your website. The script is available in

PHP, Perl and ASP versions. No programming knowledge needed to install
this script and configure your forms to work with it.

One script can handle unlimited amount of any sophisticated forms. You
have full layout and design control. The script is

featured with:

    * auto responder;
    * "preview" and "thank you" pages;
    * supports attachments, calculations, "if" condition, variable
field validations, html emails;
    * supports multiple pages forms, database data storing and much
more features!

Operating system and software installed.
-Apache 1.3.37
-Form Mail: eMail Form Processor Pro (c) 2000-2003 MitriDAT
-The date stamp for this product is year 2000-2003.
-Mitridat's customer demo on their website has the same date stamp.

How the vulnerability can be reproduced
-A HTTP POST to the following parameters with either an IFRAME or SCRIPT tag.
base_path=

What impact the vulnerability has on the vulnerable system?
By enticing a user to click on a crafted url, an attacker can execute
arbitrary script code on the victim's browser.

Any additional details that might help in the verification process.
This initial discovery was on a customer running Mitridat's Form
Processor Pro.  I was then able to verify the parameter by looking up
Mitridat's website and verifying the xss from their public demo.

Mitridat has demo's of the Form Processor Pro for public view.
http://www.mitridat.com/products-form-processor-pro.html
http://www.email-form.com/online-demo.html

Here are tested POSTs I've done on Mitridat's public internet demo's.

URL
http://www.email-form.com/sample-forms/simple-contact-form-with-preview/simple-contact-form-with-preview.html

POST
base_path=<iframe
src=/>&r_Name=&Company-Name=&re_eMail=&Web-Site-URL=http%3A%2F%2F&r_Country=&Phone=&Fax=&r_Subject=&r_Message=&ok2.x=39&ok2.y=13

POST
base_path=<script>alert(1111)</script>&r_Name=&Company-Name=&re_eMail=&Web-Site-URL=http%3A%2F%2F&r_Country=&Phone=&Fax=&r_Subject=&r_Message=&ok2.x=17&ok2.y=6

Charles H Kim