> /home/destiney/domains/ratedsite.com/public_html/stats.php on line 624
>
> Notice: Undefined variable: alt in
> /home/destiney/domains/ratedsite.com/public_html/stats.php(640) : > eval()'d code on line 4
>
> Notice: Undefined variable: desc in
> /home/destiney/domains/ratedsite.com/public_html/stats.php(640) : eval()'d code on line 8
Full path disclosure only occurs when the error reporting level $GLOBALS[ 'SITE_DEBUG' ] is set on. In production mode, $GLOBALS[ 'SITE_DEBUG' ] = 0, so full paths are never shown. I don't consider this an exploit as the script users are told the proper setting for production deployment is 0. Neverthless I have changed the default setting from 1 to 0 in the distribution copy of config.php-dist.
> addWeblog.php Exploit:
>
> The input box for addweblog.php and leaveComments.php allows ceritan HTML
> tags include the <div> tag.
>
> The comment reply input boxes not allow ceritan html tags, one being the
> <div> tag A user can add java script to the div tag and commit a XSS.
Even though I am unable to find any example XSS code that works as you described, I will go ahead and remove the <div> tag from the allowed tag list in the config.php-dist file.
Alot of people use this script, thanks for no early/private disclosure whatsoever.
> Effected Files:
You mean affected? `Effected` is not a word.
> addWeblog.php
I pasted the following example XSS code into both form fields, and saw no evidence of XSS vulnerabilities:
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0
063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.105
3\0053\0027\0029'\0029">
<DIV STYLE="background-image: url(javascript:alert('XSS'))">
<DIV STYLE="width: expression(alert('XSS'));">
Did you have an example of a <div> tag that works?
> leaveCommentReply.php
Since the same form input cleansing code is in place for all forms and incoming GPC data site-wide, I did not test this form page.
> stats.php
>
> ------
>
> stats.php Exploit:
>
> SQL Injection of stats.php leads to full path disclosures.
>
> Example:
>
> http://www.example.com/stats.php?s=SELECT SUM( rating )FROM ds_image_ratings
> WHERE created ='x'
>
> Notice: Undefined variable: scriptName in
> /home/destiney/domains/ratedsite.com/public_html/stats.php on line 624
>
> Notice: Undefined variable: alt in
> /home/destiney/domains/ratedsite.com/public_html/stats.php(640) : > eval()'d code on line 4
>
> Notice: Undefined variable: desc in
> /home/destiney/domains/ratedsite.com/public_html/stats.php(640) : eval()'d code on line 8
Full path disclosure only occurs when the error reporting level $GLOBALS[ 'SITE_DEBUG' ] is set on. In production mode, $GLOBALS[ 'SITE_DEBUG' ] = 0, so full paths are never shown. I don't consider this an exploit as the script users are told the proper setting for production deployment is 0. Neverthless I have changed the default setting from 1 to 0 in the distribution copy of config.php-dist.
> addWeblog.php Exploit:
>
> The input box for addweblog.php and leaveComments.php allows ceritan HTML
> tags include the <div> tag.
>
> The comment reply input boxes not allow ceritan html tags, one being the
> <div> tag A user can add java script to the div tag and commit a XSS.
Even though I am unable to find any example XSS code that works as you described, I will go ahead and remove the <div> tag from the allowed tag list in the config.php-dist file.
Alot of people use this script, thanks for no early/private disclosure whatsoever.
[ reply ]