POSH Local File Include and Cross Site Scripting Vulnerabilities
BID:50077
Info
POSH Local File Include and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 50077 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 12 2011 12:00AM |
| Updated: | Oct 12 2011 12:00AM |
| Credit: | Crashfr |
| Vulnerable: |
Portaneo POSH 3.1.1 |
| Not Vulnerable: |
Portaneo POSH 3.1.2 |
Discussion
POSH Local File Include and Cross Site Scripting Vulnerabilities
POSH is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to POSH 3.1.2 are vulnerable.
POSH is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Versions prior to POSH 3.1.2 are vulnerable.
Exploit / POC
POSH Local File Include and Cross Site Scripting Vulnerabilities
Attackers can exploit these issues through a browser. To exploit a cross-site scripting issue, attackers must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/posh/portal/login.php?message=XSS%20Catched%20!%22%29%29;alert%28%22XSS%22%29
http://www.example.com/posh/portal/scr_changelang.php => POST lang=../../../../../../etc/passwd%00
POST http://www.example.com/posh/portal/scr_changelang.php HTTP/1.1
lang=../../../../../../../../../../../../../../../../etc/passwd%00
Attackers can exploit these issues through a browser. To exploit a cross-site scripting issue, attackers must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/posh/portal/login.php?message=XSS%20Catched%20!%22%29%29;alert%28%22XSS%22%29
http://www.example.com/posh/portal/scr_changelang.php => POST lang=../../../../../../etc/passwd%00
POST http://www.example.com/posh/portal/scr_changelang.php HTTP/1.1
lang=../../../../../../../../../../../../../../../../etc/passwd%00
Solution / Fix
POSH Local File Include and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references for more details.
Solution:
Updates are available. Please see the references for more details.
References
POSH Local File Include and Cross Site Scripting Vulnerabilities
References:
References:
- POSH Homepage (Portaneo)