full-disclosure - Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by Daronet Internet Solutions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <000401c6fd1d$0b959870$6502a8c0@zionsecutiy>
Date: Tue, 31 Oct 2006 18:30:16 +0200
From: "LegendaryZion" <moskito@...le.net.il>
To: <bugs@...uritytracker.com>, "BugTraq" <bugtraq@...urityfocus.com>,
	<news@...uriteam.com>, <full-disclosure@...ts.grok.org.uk>
Subject: Cross Site Scripting (XSS) Vulnerability in
	"ViewImage.asp" by Daronet Internet Solutions

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by 
Daronet Internet Solutions
Discovered Date: 29/01/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.daronet.co.il

Details:

Daronet Internet Solutions website platform is prone to a Cross Site 
Scripting Vulnerability.
The vulnerability exists in "ViewImage.asp" file, caused by the lack of 
Input Validation/Filtering
of quotation and HTML characters in the GET parameter "Image".
The use of "ViewImage.asp" is done by "Funclib.js".

Contents of Funclib.js:
---------------------------------
...

function fnShowFullImg(sFile) {
 window.open("ViewImage.asp?Image="+sFile,"image","top=50,left=50,width="+(screen.availWidth-100)+",height="+(screen.availHeight-100)+",scrollbars");}...After the function is being called, ViewImage.asp prints the following HTMLcode:------------------------------------------------------------------------------------------------------------------...<td style="border: 2px solid #FFFFFF;"><img src="<Unfiltered Input>"style="border: 1px solid #000000;"></td>...Exploitation URL:http://www.example.com/ViewImage.asp?Image=">your xss code hereSuccessful exploitation may allow execution of script code. This could alsobe exploited to spoof the entire website's content,create fake login menu's for all the platform's users, commit Denial OfService attacks and more...Proof Of Concept:http://www.example.com/ViewImage.asp?Image="><script>alert()<script>To view the full list of vulnerable websites:http://www.daronet.co.il/Index.asp?CategoryID=46&SubjectID=&Page=1Even http://www.2bsecure.co.i
 l!
....XSS + Phishing + Social =Daronet Internet Solutions provide an Administration System,that help customers to manage there website by log in to vulnerable XSSpage.The attacker has full access to the retrieved web page just as fake loginpage to the administration system,that cause customer may unintentionally login to attacker fake login page,and send the password of the administration system to the attacker.("hackthe website").http://support.daronet.com/usermanual4.0/ViewImage.asp?Image=">Your XSS codeherehttp://support.daronet.com/basic3/ViewImage.asp?Image=">Your XSS code hereThanks,Tal Argoni, CEHwww.zion-security.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/