full-disclosure - Geeklog 1.7.1 <= Cross Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AANLkTinzrDx2xng9COdOUY7=X3nhvokerau3HeidngV3@mail.gmail.com>
Date: Tue, 4 Jan 2011 00:49:55 +0800
From: YGN Ethical Hacker Group <lists@...g.net>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, 
	bugs@...uritytracker.com, vuln@...unia.com, secalert@...urityreason.com,
	news@...uriteam.com, vuln@...urity.nnov.ru, moderators@...db.org
Subject: Geeklog 1.7.1 <= Cross Site Scripting
	Vulnerability

==========================================
 Geeklog 1.7.1 <= Cross Site Scripting Vulnerability
==========================================

1. OVERVIEW

The Geeklog was vulnerable to Cross Site Scripting in its administration
backend.

2. BACKGROUND

Geeklog is a PHP/MySQL based application for managing dynamic web content.
"Out of the box", it is a blog engine, or a CMS with support for comments,
trackbacks,
multiple syndication formats, spam protection, and all the other vital
features of such a system.

3. VULNERABILITY DESCRIPTION

User supplied input is not probably sanitized in the "subgroup" and
"conf_group"
parameters when the configuration settings are saved in
/admin/configuration.php.
Attackers who manage to get/bypass anti-csrf token (_glsectoken) via other
means can effectively perform XSS against admin users.

4. VERSIONS AFFECTED

1.7.1 and lower

5. PROOF-OF-CONCEPT/EXPLOIT

[Request]

POST /geeklog/admin/configuration.php HTTP/1.1

_glsectoken=&conf_group=Core'"--></script><script>alert(/XSS/)</script>&subgroup='"--></script><script>alert(/XSS/)</script>

[/Request]

6. SOLUTION

Upgrade to 1.7.1sr1

7. VENDOR

Geeklog Development Team
http://www.geeklog.net/

8. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.

9. DISCLOSURE TIME-LINE

2010-12-31: notified vendor
2011-01-02: vendor released fixed version
2011-01-04: vulnerability disclosed

10. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/[geeklog1.7.1]_cross_site_scripting
Vendor Advisory: http://www.geeklog.net/article.php/geeklog-1.7.1sr1
About Geeklog: http://www.geeklog.net/docs/english/#introduction
http://stephensclafani.com/2009/05/26/exploiting-unexploitable-xss/
http://kuza55.blogspot.com/2008/02/exploiting-csrf-protected-xss.html

#yehg [2011-01-04]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/