bugtraq - Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 01 Jan 2008 15:12:08 +0100
From: Audun Larsen <audun@...io.no>
To: bugtraq@...urityfocus.com
Subject: Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search

------------------------------------------------------------------------
Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search
------------------------------------------------------------------------

Author: Audun Larsen (larsen at xqus dot com)
Date: Dec 29, 2007

--AFFECTED SOFTWARE--------------------------

Name: phpWebSite
Version: 1.4.0
Release date: Dec 11, 2007

Developed by the Web Technology Group at Appalachian State University,
phpWebSite provides a complete web site content management system ( CMS ).
All client output is XHTML 1.0 and meets the
W3C's Web Accessibility Initiative requirements.

--DISCUSSION---------------------------------

The phpWebSite CMS is vulnerable to a Non-Persistent (or reflected)
Cross-Site Scripting attack. The problem exists because of the lack
of properly escaping user input before using it to generate links on
the search result page.

--PROOF OF CONCEPT---------------------------

http://phpwebsite.example.com/index.php?module=search&user=search
&search=%22%3E%3Ch1%3EXSS%3C%2Fh1%3E&alternate=local&mod_title=all&submit=Search

--TIMELINE-----------------------------------

Dec 29, 2007: Bug found
Dec 29, 2007: Vendor notified
DEc 31, 2007: Vendor reports that the bug is fixed
Jan 1 , 2008: Posted to Bugtraq

--DISCLAIMER---------------------------------

The information in this advisory and any of its demonstrations is provided
"as is" without warranty of any kind.

Copyright © 2007 Audun Larsen, some rights reserved:
http://creativecommons.org/licenses/by-sa/3.0/