BugTraq
Back to list
|
Post reply
More Critical Vulnerabilities In PHP Topsites
Jan 21 2003 05:00PM
JeiAr (jeiar kmfms com)
Version: All
Script: edit.php
vendor: itop10.net
Type: Code Injection/Execution Vulnerability
------------------------------------------------------------------------
---
Another critical vulnerability has been found by the CyberArmy Security
Research Team that effects php topsites. Basically, it is a different
script vulnerable to the same attack as the previously released add.php
vuln. A user cannot submit a site with invalid metacharacters if a php
topsites owner or admin has applied the patch, or written an ereg himself
or used the htmlspecialchars() function etc. However once accepted a
malicious user can edit thier site description and then submit the site
for revalidation. Upon viewing the site submitted for revalidation, any
code injected into the description field (or other fields) will be run by
the admin unknowingly.
Version: All
Script: edit.php
vendor: itop10.net
Type: SQL Injection/User Account Disclosure Vulnerability
------------------------------------------------------------------------
---
PHP Topsites has a very poor authentication system, thus by adding the
variable auth=1 and terminating the SQL query with the -- characters an
attacker can gain access to any user account he/she has an account number
for. You can TRY to quickly patch this by specifying a refferer and method
type, but it's advised to just get another topsites script since there
is no real fix for this that would be very secure. Below is an example of
how an attacker can disclose user account info via a malformed url. This
works even if the previous fix to edit.php was applied.
http://somewebsite.com/topsitesdir/edit.php?
a=pre&submit=&auth=1&sid=thesiteidnumgoeshere--
The writer of the scripts located at http://www.itop10.net really doesn't
seem to care about keeping his users safe, as he has not issued a warning
to potential customers as well as existing customers. Nor has he quit
selling the buggy scripts for 60$ US a pop. I am no lawyer, but isn't
this somewhat illegal? Negligance maybe? Ah well, you guys decide, Im sure
someone out there is a lawyer. Cheers :)
JeiAr
All credit goes to The CyberArmy Security Research ACAT Team
http://www.security-research.org
http://www.gulftech.org
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
Version: All
Script: edit.php
vendor: itop10.net
Type: Code Injection/Execution Vulnerability
------------------------------------------------------------------------
---
Another critical vulnerability has been found by the CyberArmy Security
Research Team that effects php topsites. Basically, it is a different
script vulnerable to the same attack as the previously released add.php
vuln. A user cannot submit a site with invalid metacharacters if a php
topsites owner or admin has applied the patch, or written an ereg himself
or used the htmlspecialchars() function etc. However once accepted a
malicious user can edit thier site description and then submit the site
for revalidation. Upon viewing the site submitted for revalidation, any
code injected into the description field (or other fields) will be run by
the admin unknowingly.
Version: All
Script: edit.php
vendor: itop10.net
Type: SQL Injection/User Account Disclosure Vulnerability
------------------------------------------------------------------------
---
PHP Topsites has a very poor authentication system, thus by adding the
variable auth=1 and terminating the SQL query with the -- characters an
attacker can gain access to any user account he/she has an account number
for. You can TRY to quickly patch this by specifying a refferer and method
type, but it's advised to just get another topsites script since there
is no real fix for this that would be very secure. Below is an example of
how an attacker can disclose user account info via a malformed url. This
works even if the previous fix to edit.php was applied.
http://somewebsite.com/topsitesdir/edit.php?
a=pre&submit=&auth=1&sid=thesiteidnumgoeshere--
The writer of the scripts located at http://www.itop10.net really doesn't
seem to care about keeping his users safe, as he has not issued a warning
to potential customers as well as existing customers. Nor has he quit
selling the buggy scripts for 60$ US a pop. I am no lawyer, but isn't
this somewhat illegal? Negligance maybe? Ah well, you guys decide, Im sure
someone out there is a lawyer. Cheers :)
JeiAr
All credit goes to The CyberArmy Security Research ACAT Team
http://www.security-research.org
http://www.gulftech.org
[ reply ]