phpwind 8.7 Cross Site Scripting

`*phpwind v8.7 XSS (Cross-site Scripting) Web Security Vulnerabilities*  
  
  
Exploit Title: phpwind v8.7 goto.php? &url Parameter XSS Security  
Vulnerabilities  
Product: phpwind  
Vendor: phpwind  
Vulnerable Versions: v8.7  
Tested Version: v8.7  
Advisory Publication: May 25, 2015  
Latest Update: May 25, 2015  
Vulnerability Type: Cross-Site Scripting [CWE-79]  
CVE Reference: *  
Impact CVSS Severity (version 2.0):  
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)  
Impact Subscore: 2.9  
Exploitability Subscore: 8.6  
Writer and Reporter: Wang Jing [School of Physical and Mathematical  
Sciences (SPMS), Nanyang Technological University (NTU), Singapore]  
(@justqdjing)  
  
  
  
  
  
  
*Caution Details:*  
  
  
*(1) Vendor & Product Description:*  
  
  
*Vendor:*  
phpwind  
  
  
  
*Product & Vulnerable Versions:*  
phpwind  
v8.7  
  
  
  
*Vendor URL & Download:*  
Product can be obtained from here,  
http://www.phpwind.net/thread/166  
  
  
  
  
*Product Introduction Overview:*  
"phpwind (abbreviation: pw) is a program based on PHP and MySQL open source  
community, and is one of the most popular general-Forum. phpwind ofstar  
first version was released in 2004. As of December 2013 phpwind brand items  
calculated by Ali cloud Co., Ltd. has, fully free open source software. Now  
accumulated more than one million websites use phpwind products, of which  
nearly 100,000 active website. Since the 2011 release PHPWind8.x series  
version, phpwind enhance community around the content value and promote  
community e-commerce two general direction of the development of multi-mode  
single-core products and achieve new forms of community. 2012 preparations  
for the release of phpwind9.0 will use self-developed Windframework phpwind  
framework and integrated computing architecture and so on Ali community  
cloud platform application center will provide a variety of solutions for  
future communities.  
  
Today, the country's 200,000 worth of small sites, there are nearly 100,000  
community site uses phpwind, has accumulated more than one million sites  
use phpwind, there are 1,000 new sites every day use phpwind. These  
community sites covering 52 types of trades every day one million people  
gathered in phpwind build community, issued 50 million new information,  
visit more than one billion pages.  
National Day PV30 million or more in 1000 about a large community, there  
are more than 500 sites selected phpwind station software provided,  
including by scouring link Amoy satisfaction, a daily e-commerce and  
marketing groups, and other on-line product vigorously increase in revenue  
for the site. Excellent partners, such as Xiamen fish, of Long Lane, Erquan  
network, Kunshan forum, the North Sea 360, Huizhou West Lake, Huashang  
like."  
  
  
  
  
*(2) Vulnerability Details:*  
phpwind web application has a computer cyber security bug problem. It can  
be exploited by XSS attacks. This may allow a remote attacker to create a  
specially crafted request that would execute arbitrary script code in a  
user's browser session within the trust relationship between their browser  
and the server.  
  
Several other similar products 0-day vulnerabilities have been found by  
some other bug hunter researchers before. phpwind has patched some of them.  
CXSECurity is a huge collection of information on data communications  
safety. Its main objective is to inform about errors in various  
applications. It also publishes suggestions, advisories, solutions details  
related to XSS vulnerabilities and cyber intelligence recommendations.  
  
  
*(2.1)* The first programming code flaw occurs at "&url" parameter in  
"/goto.php?" page.  
  
  
  
  
  
  
  
*References:*  
http://www.tetraph.com/security/xss-vulnerability/phpwind-v8-7-xss/  
http://securityrelated.blogspot.com/2015/05/phpwind-v87-xss.html  
https://itswift.wordpress.com/2015/05/24/phpwind-v8-7-xss/  
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01904.html  
http://whitehatpost.blog.163.com/blog/static/24223205420154248491580/  
http://cxsecurity.com/issue/WLB-2015040033  
http://diebiyi.com/articles/security/phpwind-v8-7-xss/  
http://seclists.org/fulldisclosure/2015/Apr/38  
http://lists.openwall.net/full-disclosure/2015/04/05/9  
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1954  
  
  
  
  
  
--  
Jing Wang,  
Division of Mathematical Sciences (MAS),  
School of Physical and Mathematical Sciences (SPMS),  
Nanyang Technological University (NTU),  
Singapore.  
http://www.tetraph.com/wangjing/  
https://twitter.com/justqdjing  
  
  
`