Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
NuKed-KlaN PHP Gateway Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1005993 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 27 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): beta 1.2 and prior versions
|
Description: An input validation vulnerability was reported in the NuKed-KlaN PHP-based forum software. A remote user can conduct cross-site scripting attacks against web forum users.
Security Corporation released an advisory warning of flaws in the Guestbook, Forum, and Shoutbox modules.
In the Guestbook module,
a remote user can insert specially crafted text into the "author" field so that when a target user views the Guestbook entry, arbitrary
scripting code will be executed by the target user's browser. The code will originate from the site running NuKed-KlaN and will
run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication
cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take
actions on the site acting as the target user.
In the Forum, the vulnerable fields are the "Titre" and "Pseudo" fields.
In
the Shoutbox module, the submit.php script presents the vulnerable "La Tribune Libre" field.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running NuKed-KlaN,
access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution: The vendor has reportedly released a fixed version (beta 1.3), available at:
http://www.nuked-klan.org/
|
Vendor URL: www.nuked-klan.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: gregory.lebras@security-corp.org
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 26 Jan 2003 02:09:09 +0100
From: =?iso-8859-1?Q?Gr=E9gory_Le_Bras_|_Security_Corporation?= <gregory.lebras@security-corp.org>
Subject: [Full-Disclosure] [SCSA-003] Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan
|
.: Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan :.
________________________________________________________________________
Security Corporation Security Advisory [SCSA-003]
________________________________________________________________________
PROGRAM: Nuked-Klan
HOMEPAGE: http://www.nuked-klan.org
VULNERABLE VERSIONS: beta 1.2 and prior
________________________________________________________________________
DESCRIPTION
________________________________________________________________________
Nuked Klan is a PHP Gateway for "clans". (direct quote from Nuked Klan
website)
DETAILS & EXPLOITS
________________________________________________________________________
Many Cross-Site Scripting vulnerabilities have been found in Nuked Klan
which allow attackers to inject script codes into the page and use them on
clients browser as if they were provided by the site.
These Cross-Site Scripting vulnerabilities are found in the following
modules : Guestbook, Forum, Shoutbox.
An attacker can input specially crafted links and/or other malicious
scripts.
Guestbook
________________________________________________________________________
A vulnerability was discovered in the page for posting messages, at this
adress :
http://[target]/index.php?file=Guestbook&req=post_book
The vulnerability is at the level of the interpretation of the "Author"
field.
Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator of
the visitors.
The hostile code could be :
[script]alert("Cookie="+document.cookie)[/script]
(open a window with the cookie of the visitor.)
(replace [] by <>)
Forum
________________________________________________________________________
A vulnerability was discovered in the page for posting new messages in the
forum, at this adress :
http://[target]/index.php?file=Forum&op=post_screen&forum_id=0
The vulnerability is at the level of the interpretation of the "Titre" and
"Pseudo" field.
Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator of
the visitors.
The hostile code could be :
[script]alert("Cookie="+document.cookie)[/script]
(open a window with the cookie of the visitor.)
(replace [] by <>)
Shoutbox
________________________________________________________________________
A vulnerability was discovered in the page for posting messages in "La
Tribune Libre".
Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator of
the visitors.
The hostile code could be :
[script]alert("Cookie="+document.cookie)[/script]
(open a window with the cookie of the visitor.)
(replace [] by <>)
-------Vulnerable line in submit.php--------
$shout = str_replace("|","",$SB_text);
--------------------------------------------
Possible solutions: modify the code in order to analyze the whole of the
text sent by the user and to replace the hostile elements.
---------------Code example-----------------
<?
$SB_text = str_replace("<", "[", $SB_text);
$SB_text = str_replace(">", "]", $SB_text);
$SB_text = htmlentities($SB_text);
$shout = str_replace("|","",$SB_text);
?>
--------------------------------------------
SOLUTIONS
________________________________________________________________________
Upgrade your version to beta 1.3
Upgrade Guestbook with the appropriate patch :
http://tomysnockers.net/download/Guestbook.rar
Upgrade Shoutbox with the appropriate patch :
http://www.nuked-klan.org/files/Shoutbox_13.zip
VENDOR STATUS
________________________________________________________________________
The vendor has reportedly been notified.
LINKS
________________________________________________________________________
http://www.security-corp.org/index.php?ink=4-15-1
-----------------------------------------------------------------
Grégory Le Bras aka GaLiaRePt | http://www.Security-Corp.org
-----------------------------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
Go to the Top of This SecurityTracker Archive Page
|
