XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk
  1. Board index / 
  2. Xoops Development / 
  3. Xoops Bug Reports
  4. Xoops 2.0 Bug Report 
  5.  / XSS vulnerability in XOOPS 2.0.5.1
Register
1
multivac
XSS vulnerability in XOOPS 2.0.5.1

  • 2003/12/23 16:49

  • multivac

  • Just popping in

  • Posts: 3

  • Since: 2003/12/9


Subject: XSS vulnerability in XOOPS 2.0.5.1
Date: 15:44, domenica 21 dicembre 2003
From: Chintan Trivedi
To: bugtraq@securityfocus.com

====================================================================
Advisory by Eye On Security Research Group - India http://www.eos-india.net
====================================================================



1.==============================================================Product
2.===============================================================Vendor
3.========================================================Vulnerability
4.========================================================About Product
5.=============================================Details of vulnerability
6.==============================================================Exploit
7.==============================================================Credits




1. Product
==========

XOOPS 2.0.5.1


2. Vendor
=========

http://www.xoops.org


3. Vulnerability
================

XSS vulnerability in module weblinks


4. About XOOPS
==============

XOOPS is a dynamic OO (Object Oriented) based open source portal
script written in PHP. XOOPS supports a number of databases, making
XOOPS an ideal tool for developing small to large dynamic community
websites, intra company portals, corporate portals, weblogs and much
more.


5. Details of vulnerability
===========================

The weblinks module contains a file named "myheader.php" in
/modules/mylinks/ directory. The code of the file is as follow :

---------------------------------
include "../../mainfile.php";
$url = $HTTP_GET_VARS['url'];
$lid = intval($HTTP_GET_VARS['lid']);
.
.
.

| href="modlink.php?lid="> |
_MD_REPORTBROKEN; ?> | _MD_TELLAFRIEND; ?> | Back to | target='_top' href="">Close Frame
.
.
-----------------------------------

The value for variable "url" is used in line
Close Frame

Thus an attacker can pass a javascript code as a value for variable
url and get it executed as soon as the victim clicks the "Close Frame"
link.


6. Exploit
==========

http://[target]/modules/mylinks/myheader.php?url=javascript:alert(docum
ent.cookie);

Clicking the above link, the victim gets directed to a page containing
a link "Close Frame" which is actually the javascript code inserted by
the attacker. The cookie revealed is quite informatic for the attacker
to login with the hijacked user (including admin) privileges.


7. Credits
==========

Chintan Trivedi - http://www.hackersprogrammers.com
"Eye on Security Research Group - India " - http://www.eos-india.net
2
CBlue
Re: XSS vulnerability in XOOPS 2.0.5.1

If you had bothered to search the forums, you would see that this has already been reported and fixed.
3
supernix
Re: XSS vulnerability in XOOPS 2.0.5.1

  • 2003/12/23 16:56

  • supernix

  • Not too shy to talk

  • Posts: 151

  • Since: 2003/3/13


I did search the forums and this is the only thread that I can find that mentions this.

What do I search for?
4
CBlue
Re: XSS vulnerability in XOOPS 2.0.5.1

hhttps://xoops.org/modules/newbb/viewtopic.php?topic_id=14950&forum=3&post_id=61834#forumpost61834

This post is on the front page, supernix.
5
supernix
Re: XSS vulnerability in XOOPS 2.0.5.1

  • 2003/12/23 17:23

  • supernix

  • Not too shy to talk

  • Posts: 151

  • Since: 2003/3/13


Thanks I got it now

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Who's Online

338 user(s) are online (303 user(s) are browsing Support Forums)

Members: 0

Guests: 338

more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Nov 30
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits