MagpieRSS XSS 0day

[admin@xxxxxxxxxxxxx]

Hello,

I have found a Cross Site Scripting vulnerability in MagpieRSS, an RSS parser 
written in PHP, basically, this piece of software enables users to add their 
own RSS feeds to be parsed, so they can keep up to date with their favourite 
feeds, as well as the pre-defined ones.

I crafted my own RSS feed, which contains XSS inside the CDATA.

Here is the XML file I used: http://www.elites0ft.com/poc.xml

If for example, I ask a user to subscribe to my feed, after disguising it as a 
real feed, I then go and update it with malicious content, the RSS parser will 
then parse the updated content and the user will end up loading an Iframe with 
a cookie stealer inside.

The reason this happens is because the CDATA is not getting escaped, it is a 
simple fix: htmlentities() around the parsed CDATA.

This is a potentially harmful exploit if you can convince users to add your 
feed.

Thanks for reading,
system_meltdown.
[Elites0ft.com]