###################################################################
#
# Exploit Title: SPIP Core <= 3.0.1, 2.1.14, 2.0.19 XSS admin panel
# Google Dork:
# Date: 13/06/2012
# Exploit Author: x@s
# Vendor Homepage: http://www.spip.net/
# Software Link: http://www.spip.net/
# Version: <= 3.0.1, 2.1.14 or 2.0.19
# Tested on: Firefox 13
#
###################################################################
Affected file:
--------------
/spip/ecrire/inc/admin.php
###################################################################
Vuln function:
--------------
function copy_request($script, $suite, $submit='')
{
include_spip('inc/filtres');
foreach(array_merge($_POST,$_GET) as $n => $c) {
if (!in_array($n,array('fichier','exec','validation_admin')) AND !is_array($c))
$suite .= "\n";
}
return generer_form_ecrire($script, $suite, '', $submit);
}
###################################################################
Details:
--------
The variable $n isn't sanitized before being reinjected into the form generated.
###################################################################
Needs:
------
Magic_quote_gcp should be disabled.
Compatible with Firefox 13 but not Chrome.
###################################################################
Exploit generator:
------------------
XSS in SPIP Core <=3.0.1 or <=2.1.14 admin panel (base repair)
This XSS, non-persistent, use POST vars through admin panel.
The target is the attribute "name" of an input markup hidden.
This XSS work on Firefox 13, IE7, but doesn't work on Chrome.
Magic_quote_gcp = Off needed.