[FD] PhpSocial v2.0.0304: XSS

Security Advisory - Curesec Research Team 1. Introduction Affected Product: PhpSocial v2.0.0304_20222226 Fixed in: not fixed Fixed Version Link: n/a Vendor Webite: http://phpsocial.net Vulnerability Type: XSS / Open Redirect Remote Exploitable: Yes Reported to vendor: 11/21/2015 Disclosed to public: 12/21/2015 Release mode: Full Disclosure CVE: n/a Credits Tim Coen of Curesec GmbH 2. Overview CVSS Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N Description PhpSocial is a social networking software written in PHP. In version v2.0.0304, the profile fields Name, Birthday, Street Address, City, State, Country, and Phone Number are open to persistent XSS. This can lead to the stealing of cookies, injection of JavaScript keyloggers, and bypassing of CSRF protection. In this case, this can lead to code execution via the template editor. 3. Proof of Concept Visit Profile: http://localhost/PhpSocial_v2.0.0304_20222226/cms_phpsocial/ Profile.php?user=[USERNAME] Click edit and use the following for any of the vulnerable fields: 4. Open Redirect CVSS Low 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N Description PhpSocial is also vulnerable to a reflected open redirect, which may for example be used in phishing attacks. The attack only works if the victim is logged in to PhpSocial. Proof of Concept http://localhost//PhpSocial_v2.0.0304_20222226/cms_phpsocial/ UserEditprofileStatus.php?status_new=foobar&task=dosave&return_url=http:// google.com 5. Solution This issue was not fixed by the vendor. 6. Report Timeline 11/21/ Contacted Vendor (no reply) 2015 12/10/ Tried to remind vendor (no email is given, security@phpsocial.net does 2015 not exist, and contact form could not be used because the website is down) 12/21/ Disclosed to public 2015 Blog Reference: http://ift.tt/1O9CPgG

Source: Gmail -> IFTTT-> Blogger