Kloxo LxCenter Server CP 6.1.10 Cross Site Scripting

`Title:  
======  
Kloxo LxCenter Server CP v6.1.10 - Multiple Web Vulnerabilities  
  
  
Date:  
=====  
2012-02-10  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=429  
  
  
VL-ID:  
=====  
429  
  
  
Introduction:  
=============  
Scriptable, distributed and object oriented Hosting Platform. Manage  
Clients, Resellers,  
Domains, Backups, Stats, Mails and Databases. Manage everything!  
  
(Copy of the Vendor Homepage: http://www.lxcenter.org/)  
  
  
Abstract:  
=========  
Vulnerability-Lab Team discovered multiple web vulnerabilities on  
Kloxos LxCenter Server CP v6.1.10.  
  
  
Report-Timeline:  
================  
2012-02-10: Public or Non-Public Disclosure  
  
  
Status:  
========  
Unpublished  
  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
Medium  
  
  
Details:  
========  
Multiple persistant input validation vulnerabilities are detected on  
Kloxos LxCenter Server CP v6.1.10.  
The bug allows remote attacker to implement malicious script code on the  
application side (persistent).  
Successful exploitation of the vulnerability allows an attacker to  
manipulate modules/context (persistent) & can  
lead to session hijacking (user/mod/admin).  
  
  
Vulnerable Module(s):  
[+] LocalHost {Command Center}  
[+] Server > Information > Verbose Settings  
  
  
Picture(s):  
../1.png  
../2.png  
  
  
Proof of Concept:  
=================  
The vulnerabilities can be exploited by remote attackers with medium  
required user inter action. For demonstration or reproduce ...  
  
1.1  
Localhost {Command Center}  
  
<script> global_need_list = new Array(); </script><script>  
global_match_list = new Array(); </script><script>  
global_desc_list = new Array(); </script><form onsubmit=``return  
check_for_needed_variables(`command_centerlocalhost`);``  
method=``post`` enctype=``multipart/form-data`` action=``/display.php``  
id=``command_centerlocalhost`` name=``command_centerlocalhost``>  
<fieldset style=``background-color: rgb(255, 255, 255); border: 0px  
none; padding: 10px;`` width=``90%``><legend style=``  
font-weight: normal; border: 0px none;``><font color=``#303030``  
style=``font-weight: bold;``>Command Center for localhost   
</font> </legend></fieldset> <div align=``left``  
style=``background-color: rgb(255, 255, 255); width: 90%;``><div align=``  
left`` style=``width: 500px; border: 1px solid rgb(177, 192,  
240);``><input type=``hidden`` value=``pserver``  
name=``frm_o_o[0][class]``/>  
<input type=``hidden`` value=``localhost`` name=``frm_o_o[0][nname]``/>  
<div align=``left`` style=``padding: 10px; background-color: rgb(250,  
248, 248); display: block;``> Command <br/>   
... or  
<input width=``60%`` type=``text`` value=``  
name=``frm_pserver_c_ccenter_command``  
class=``frm_pserver_c_ccenter_command textbox``/>  
<iframe size=``30`` <``=`` [PERSISTENT SCRIPT CODE INJECT!]` src=``a``>  
</div> <div align=left style=`padding:10 10 10 10 ;border-top  
:1px solid #aaaaaa; background-color:#ffffff;display:block` > Output   
<br> <textarea nowrap id=textarea_ class=  
frmtextarea rows=10 style=`margin:0 0 0 50;width:85%;height:200px;`  
name=`` size=30 ></textarea>  
<script  
type=``text/javascript``>createTextAreaWithLines(`textarea_`);</script>  
<style>  
  
  
1.2  
Server => Information => 2 x Verbose Input  
  
<font color=``#303030`` style=``font-weight: bold;``>Information for  
localhost </font> </legend></fieldset>   
<div align=``left`` style=``background-color: rgb(255, 255, 255); width:  
90%;``><div align=``left`` style=``width: 500px; border: 1px  
solid rgb(177, 192, 240);``><input type=``hidden`` value=``pserver``  
name=``frm_o_o[0][class]``/>  
<input type=``hidden`` value=``localhost``  
name=``frm_o_o[0][nname]``/>  
<script> global_need_list[`frm_pserver_c_description`] = `Verbose  
Description (to Identify)`; </script>  
<div align=``left`` style=``padding: 10px; background-color: rgb(250,  
248, 248); display: block;``> Verbose Description (to Identify)  
<font color=``red``><sup>*</sup></font> <br/>   
<input width=``60%`` type=``text`` [PERSISTENT SCRIPT CODE INJECT!]``  
<iframe=`` value=``  
>`` name=``frm_pserver_c_description`` class=``frm_pserver_c_description  
textbox``/>`` size=``30``> </div> <div align=``left`` style=``  
padding: 10px; border-top: 1px solid rgb(170, 170, 170);  
background-color: rgb(255, 255, 255); display: block;``> FQDN Hostname   
<br/>   
  
<input width=``60%`` type=``text`` [PERSISTENT SCRIPT CODE INJECT!]``  
<iframe=`` value=``>`` name=``frm_pserver_c_realhostname`` class=``  
frm_pserver_c_realhostname textbox``/>`` size=``30``> </div> <div  
align=``left`` style=``padding: 10px; border-top: 1px solid rgb(170,  
170, 170); background-color: rgb(250, 248, 248); display: block;``> Load  
Threshold At Which Warning Is Sent <br/>   
<input width=``60%``  
type=``text`` size=``30`` value=``20``  
name=``frm_pserver_c_load_threshold``  
class=``frm_pserver_c_load_threshold textbox``/> </div> <input type=  
``hidden`` value=``update`` name=``frm_action``/>  
<input type=``hidden`` value=``information`` name=``frm_subaction``/>  
  
  
Reference(s):  
../command-center.txt  
../server-verbose-input.txt  
  
  
Risk:  
=====  
The security risk of the persistent input validation vulnerabilities is  
estimated as medium(+).  
  
  
Credits:  
========  
Vulnerability Research Laboratory - N/A Anonymous  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without  
any warranty. Vulnerability-Lab disclaims all warranties,  
either expressed or implied, including the warranties of merchantability  
and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including  
direct, indirect, incidental, consequential loss of business  
profits or special damages, even if Vulnerability-Lab or its suppliers  
have been advised of the possibility of such damages. Some  
states do not allow the exclusion or limitation of liability for  
consequential or incidental damages so the foregoing limitation  
may not apply. Any modified copy or reproduction, including partially  
usages, of this file requires authorization from Vulnerability-  
Lab. Permission to electronically redistribute this alert in its  
unmodified form is granted. All other rights, including the use of  
other media, are reserved by Vulnerability-Lab or its suppliers.  
  
Copyright © 2012|Vulnerability-Lab  
  
  
  
--   
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com  
Contact: [email protected] or [email protected]  
  
`