[HSC Security Group] Multiple XSS in phpopenchat 3.0.2
Hackers Center Security Group (http://www.hackerscenter.com/)
Zinho's Security Advisory
Desc: Multiple XSS in phpopenchat 3.0.2
Risk: Medium to High
"PHPOpenChat is a high performance php-based chat server software for a live
chat-room or -module on every php-based site."
1. (permanent) XSS hole in profile.php and profile_misc.php
"title" and "content" arguments passed with method POST are not sanitized and
can generate a permanent XSS hole thus stealing cookie of anyone viewing the
user profile page
2. (permanent) XSS hole due to the previous in userpage.php. A malicious user
can manipulate the profile fields and the script will be executed in
userpage.php
2. (permanent) XSS hole in mail.php
Probably the most dangerous as it can be directed against a specified user
knowing just his nickname.
"subject", "body" and the other email parameters are not sanitized.
3. (temporary) XSS hole in invite.php
"disinvited_chatter" and "invited_chatter"
Vendor has been contacted some days ago but we got no reply so far.
-- HSC Security Group
Get your site audited for free and ay only if we find it vulnerable!
http://www.hackerscenter.com/security
Security researcher? Join us: mail me at zinho@xxxxxxxxxxxxxxxxx