<<< Date Index >>>     <<< Thread Index >>>

Multiple XSS Vulnerabilities in World Recipe 2.11



Armorize Technologies Security Advisory (Armorize-ADV-2008-0001)

Title:  Multiple XSS Vulnerabilities in World Recipe 2.11

Date:   2008/12/15

Status: Full

Class:  Input Validation Error

Bugtraq ID:     N/A

Category:       Cross Site Scripting

Language:       ASP.NET (C#)

Description     Armorize-ADV-2008-0001 discloses multiple cross-site scripting 
vulnerabilities that are found in World Recipe, which is an ASP.NET 2.0 C# 
application and SQL Database with stored procedure to contain and display 
recipes in a wide variety of categories.

Discussion      World Recipe is vulnerable to cross-site scripting attack 
because it fails to properly sanitize user-supplied input. Exploiting this 
vulnerability may allow an attacker to make targeted users executing arbitrary 
scripts in the context of the affected website. As a result, the attacker may 
be able to steal authentication credentials such as cookie, to alter the 
integrity of the visited page, and to launch other attacks such as phishing and 
force redirect.


Exploit:

http://www.example.com/[PATH]/emailrecipe.aspx
GET variables "n" is vulnerable.

http://www.example.com/[PATH]/recipedetail.aspx
GET variable "id" is vulnerable.

http://www.example.com/[PATH]/validatefieldlength.aspx
GET variable "catid" is vulnerable.


Vulnerable
Vendor: Ex-designz (http://www.ex-designz.net/)
Software:       World Recipe
Version:        2.11
URL:    http://www.ex-designz.net/softwaredetail.asp?fid=1884


Suggested Solution:
1. Constrain all input.
2. Reject all prohibited input.
3. Escape every input.

Disclosure Timeline:
2008/12/12 Vendor notification
2008/12/15 Full disclosure at SecurityFocus mailing list

Credit: Armorize Security Taskforce (ASF) at Armorize Technologies, Inc. 
(security dot armorize dot com)
Armorize Technologies is a software security company focusing on Web 
application security. The award-winning automated source code analysis 
solution, CodeSecure, provides the simplest and most accurate solution for 
identifying the root causes of vulnerabilities directly in the Web application 
source code and for enforcing Secure Software Development Lifecycle (Secure 
SDLC) effectively and efficiently.  Find out more at Armorize Technologies 
website, http://www.armorize.com.