LabWiki Multiple Cross Site Scripting And Arbitrary File Upload Vulnerabilities
BID:50608
Info
LabWiki Multiple Cross Site Scripting And Arbitrary File Upload Vulnerabilities
| Bugtraq ID: | 50608 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 09 2011 12:00AM |
| Updated: | Nov 09 2011 12:00AM |
| Credit: | muuratsalo |
| Vulnerable: |
PHP Labware LabWiki 1.1 PHP Labware LabWiki 1.0 |
| Not Vulnerable: | |
Discussion
LabWiki Multiple Cross Site Scripting And Arbitrary File Upload Vulnerabilities
LabWiki is prone to multiple cross-site scripting and arbitrary file upload vulnerabilities because the software fails to sufficiently sanitize user-supplied input
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to upload arbitrary files and execute arbitrary code with administrative privileges. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
LabWiki 1.1 and prior are vulnerable.
LabWiki is prone to multiple cross-site scripting and arbitrary file upload vulnerabilities because the software fails to sufficiently sanitize user-supplied input
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to upload arbitrary files and execute arbitrary code with administrative privileges. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
LabWiki 1.1 and prior are vulnerable.
Exploit / POC
LabWiki Multiple Cross Site Scripting And Arbitrary File Upload Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/LabWiki/index.php?from=";></><script>alert('muuratsalo')</script>&help=true&page=What_is_wiki
http://www.example.com/LabWiki/recentchanges.php?nothing=nothing&page_no=";></><script>alert('muuratsalo')</script>
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/LabWiki/index.php?from=";></><script>alert('muuratsalo')</script>&help=true&page=What_is_wiki
http://www.example.com/LabWiki/recentchanges.php?nothing=nothing&page_no=";></><script>alert('muuratsalo')</script>
Solution / Fix
LabWiki Multiple Cross Site Scripting And Arbitrary File Upload Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
LabWiki Multiple Cross Site Scripting And Arbitrary File Upload Vulnerabilities
References:
References:
- LabWiki Web Site (PHP Labware)