From gregory.lebras@security-corp.org Mon Mar 3 01:49:55 2003 From: Gregory Le Bras | Security Corporation To: full-disclosure@lists.netsys.com Date: Sun, 2 Mar 2003 22:31:53 +0100 Subject: [Full-Disclosure] [SCSA-008] Cross Site Scripting & Script Injection Vulnerability in PY-Livredor [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ________________________________________________________________________ Security Corporation Security Advisory [SCSA-008] ________________________________________________________________________ PROGRAM: PY-Livredor HOMEPAGE: http://www.py-scripts.com http://www.scripts-php.com VULNERABLE VERSIONS: v1.0 ________________________________________________________________________ DESCRIPTION ________________________________________________________________________ PY-Livredor is an easy guestbook script using Php4 and MySql with an administration which allow messages deletion. DETAILS ________________________________________________________________________ A Cross-Site Scripting vulnerability have been found in PY-Livredor which allow attackers to inject script codes into the guestbook and use them on clients browser as if they were provided by the website. This Cross-Site Scripting vulnerability are found in the page for posting messages (index.php) An attacker can input specially crafted links and/or other malicious scripts. EXPLOIT ________________________________________________________________________ A vulnerability was discovered in the page for posting messages, at this adress : http://[target]/livredor/index.php The vulnerability is at the level of the interpretation of the "titre", "Votre pseudo", "Votre e-mail", "Votre message" fields. Indeed, the insertion of a hostile code script in this field makes it possible to a malicious user to carry out this script on the navigator of the visitors. The hostile code could be : [script]alert("Cookie="+document.cookie)[/script] (open a window with the cookie of the visitor.) (replace [] by <>) SOLUTIONS ________________________________________________________________________ No solution for the moment. VENDOR STATUS ________________________________________________________________________ The vendor has reportedly been notified. LINKS ________________________________________________________________________ http://www.security-corp.org/index.php?ink=4-15-1 Version Française : http://www.security-corp.org/advisories/SCSA-008-FR.txt ------------------------------------------------------------ Grégory Le Bras aka GaLiaRePt | http://www.Security-Corp.org ------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html