exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

simpgb14602-xss.txt

simpgb14602-xss.txt
Posted Sep 26, 2007
Authored by Jesper Jurcenoks | Site netvigilance.com

SimpGB version 1.46.02 suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | 9de2bd44c0de616f25c85794968d049a90e806ff478bcb6a0fdc1368bda1b3b6

simpgb14602-xss.txt

Change Mirror Download
  netVigilance Security Advisory #67

SimpGB version 1.46.02 Multiple XSS Attack Vulnerabilities
Description:
SimpGB is a guestbook with data stored in MySQL, administration interface and support for multiple languages. Features: Data stored in MySQL, Administration interface, Support for multiple languages, Support for multiple instances in one database, Support for multiple layouts, Own header/footer can be defined, Support of BBCode and smilies, Admin can decide which BBCode tags to enable, Avatars (with option to let users upload their own), Admin can decide which input fields to display and which of them are required, Admins can write comments on posts, Admins can mark entry as "always on top", Admins can attach file to entry, flood protection, IP banlist, bad word list, send email notification upon new posts, optionally validate new posts before they get visible by public, own leadtext for entry form and own "Thank you" message can be defined, Option to mark posts as private (only admins can see them), search entries, Option to let users send emails out of guestbook.
External References:
Mitre CVE: ID requested but no answer received
NVD NIST: ID requested but no answer received
OSVDB: ID requested but no answer received
BUGTRAQ/BID:

Summary:
SimpGB is a guestbook with data stored in MySQL, administration interface and support for multiple languages.
Security problem in the product allows attackers to conduct XSS attacks.

Advisory URL:
http://www.netvigilance.com/advisory0067

Release Date:
09/25/2007

CVSS Version 2 Metrics:

Base Metrics:


Exploitability Metrics:



Access Vector:
Network


Access Complexity:
Low


Authentication:
None

Impact Metrics:



Confidentiality Impact:
Partial


Integrity Impact:
Partial


Availability Impact:
Partial
Temporal Metrics:


Exploitability:
Functional

Remediation Level:
Official Fix

Report Confidence:
Confirmed

CVSS Version 2 Vectors:

Base Vector:
"AV:N/AC:L/Au:N/C:P/I:P/A:P"
Temporal Vector:
"E:F/RL:OF/RC:C"

CVSS Version 2 Scores:

Base Score:
7.5

Impact Subscore:
6.4

Exploitability Subscore:
10
Temporal Score:
6.2
SecureScout Testcase ID:
TC 17986

Vulnerable Systems:
SimpGB version 1.46.02

Vulnerability Type:
XSS (Cross-Site Scripting) to force a web-site to display malicious contents to the target, by sending a specially crafted request to the web-site. The vulnerable web-site is not the target of attack but is used as a tool for the hacker in the attack of the victim.

Vendor:
Bosch IT-Consulting

Vendor Status:
The Vendor has confirmed the problem and has release new version 1.47 that addresses the problem. New version of product was tested and we can confirm that all vulnerabilities were solved. For more information see vendor announcement. To download the latest version go to vendors product download area.
Workaround:

Example:
XSS Attack Vulnerability 1:
REQUEST:
http://[TARGET]/[PRODUCT DIRECTORY]/admin/?no_rgcheck=true&lang=1&l_username=</td><script>alert(document.cookies)</script><td>
REPLY:
Will execute <script>alert(document.cookie)</script>

XSS Attack Vulnerability 2:
REQUEST:
http://[TARGET]/[PRODUCT DIRECTORY]/admin/emoticonlist.php?lang=1&l_emoticonlist=</title><script>alert(document.cookies)</script>
REPLY:
Will execute =<script>alert(document.cookie)</script>
Credits:
Jesper Jurcenoks
Co-founder netVigilance, Inc
www.netvigilance.com
??

??

??

??





Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close