·= Security Advisory =· Issue: Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by Daronet Internet Solutions Discovered Date: 29/01/2006 Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com] Product Vendor: http://www.daronet.co.il Details: Daronet Internet Solutions website platform is prone to a Cross Site Scripting Vulnerability. The vulnerability exists in "ViewImage.asp" file, caused by the lack of Input Validation/Filtering of quotation and HTML characters in the GET parameter "Image". The use of "ViewImage.asp" is done by "Funclib.js". Contents of Funclib.js: --------------------------------- ... function fnShowFullImg(sFile) { window.open("ViewImage.asp?Image="+sFile,"image","top=50,left=50,width="+(screen.availWidth-100)+",height="+(screen.availHeight-100)+",scrollbars");}...After the function is being called, ViewImage.asp prints the following HTMLcode:------------------------------------------------------------------------------------------------------------------......Exploitation URL:http://www.example.com/ViewImage.asp?Image=">your xss code hereSuccessful exploitation may allow execution of script code. This could alsobe exploited to spoof the entire website's content,create fake login menu's for all the platform's users, commit Denial OfService attacks and more...Proof Of Concept:http://www.example.com/ViewImage.asp?Image=">