bugtraq - Eggblog v3.1.0 XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071111201327.7263.qmail@securityfocus.com>
Date: 11 Nov 2007 20:13:27 -0000
From: mesut@...abs.org
To: bugtraq@...urityfocus.com
Subject: Eggblog v3.1.0 XSS Vulnerability

H - Security Labs  
Eggblog v3.1.0 Security Advisory 
ID : HSEC#20071111 
General Information
--------------------------
Name                     : EggBlog v.3.1.0
Vendor HomePage          :http://sourceforge.net/projects/eggblog/ 
Platforms                : PHP && MySQL
Vulnerability Type       : Input Validation Error

Timeline
-------------------------
08 October  2007  -- Vendor Contacted  
30 October  2007  -- Vendor Replied
11 November 2007  -- New Release
11 November 2007  -- Advisory Released


What is Eggblog
------------------------
eggblog is a free PHP & MySQL blogging package. Features include an internal search engine,

photo albums, forums, plug-ins, guest comments to blog articles, automatic monthly archiving

of blog articles and RSS XML feeds for both the blog and forums.
I discovered the security holes when I was testing it for my personel web blog.

Vulnerability Overview
------------------------
The script is vulnerable to XSS attacks.

Details About Vulnerability
------------------------
XSS Vulnerability(home/rss.php)

At the rss.php line 6-7; there are unfiltered PHP_SELFs that can be used for XSS attacks.
---------
<a

href=\"../rss/blog.php\">".$_SERVER['SERVER_NAME'].str_replace("/home/rss.php","",$_SERVER['

PHP_SELF'])."/rss/blog.php</a></li>
<a

href=\"../rss/topics.php\">".$_SERVER['SERVER_NAME'].str_replace("/home/rss.php","",$_SERVER

['PHP_SELF'])."/rss/topics.php</a></li>
---------

The attacker can succesfully launch XSS attacks with loading payload on to the URL after the

home\rss.php. For example :
http://www.example.com/home/rss.php/<script>alert(1)</script>
 
Solutions
-----------------------
Download the new release : EggBlog v3.1.1

Credits
-----------------------
The vulnerabilities found on 08 October 2007
by Mesut Timur <mesut@...abs.org>
H - Security Labs , http://www.h-labs.org
Gebze Institue of Technology,Computer Engineering,http://www.gyte.edu.tr

References
-----------------------
http://sourceforge.net/forum/forum.php?forum_id=753622
http://www.eggblog.net
http://sourceforge.net/projects/eggblog/
Original Advisory : http://www.h-labs.org/blog/2007/11/11/eggblog_v3_1_0_xss_issues.html

Mesut TIMUR
http://www.h-labs.org
H - Security Labs Güvenlik Editörü
GYTE Bilgisayar Mühendisligi