webif-xss.txt

`-----------------------------  
|| WWW.SMASH-THE-STACK.NET ||  
-----------------------------  
  
|| ADVISORY: IFNET.IT WEBIF XSS VULNERABILITY  
  
_____________________  
|| 0x00: ABOUT ME  
|| 0x01: DATELINE  
|| 0x02: INFORMATION  
|| 0x03: EXPLOITATION  
|| 0x04: GOOGLE DORK  
|| 0x05: RISK LEVEL  
____________________________________________________________  
____________________________________________________________  
  
_________________  
|| 0x00: ABOUT ME  
  
Author: SkyOut  
Date: October 2007  
Contact: skyout[-at-]smash-the-stack[-dot-]net  
Website: www.smash-the-stack.net  
  
_________________  
|| 0x01: DATELINE  
  
2007-10-15: Bug found  
2007-10-15: Email with notification sent to ifnet.it  
2007-10-21: Still no reaction from ifnet.it  
2007-10-22: Advisory released  
  
____________________  
|| 0x02: INFORMATION  
  
In the WEBIF product by the italian company ifnet, an error  
occurs due to the fact of an unfiltered variable (cmd) in the  
webif.exe program. It is possible to execute any JavaScript code  
by manipulating the parameter.  
  
_____________________  
|| 0x03: EXPLOITATION  
  
To exploit this bug no exploit is needed, all can be done through  
manipulation of the given URL:  
  
STEP 1:  
Go to the standard page of the WEBIF product, normally existing  
at "/cgi-bin/webif.exe". You will recognize some further parameters,  
being "cmd", "config" and "outconfig".  
  
STEP 2:  
Don't change any parameter instead of the "cmd" one. Change its value  
to any JavaScript code you like. For our demo we will use the default  
one, being "<script>alert('XSS');</script>".  
  
STEP 3:  
Click ENTER and execute the code. A successfull demonstration will  
popup a window.  
  
EXAMPLE:  
http://example.com/webif/cgi-bin/webif.exe?cmd=<script>alert('XSS');</script>&config=[ * ]&outconfig=[ * ]  
  
[ * ] = Depends on the server. Don't change this!  
  
____________________  
|| 0x04: GOOGLE DORK  
  
inurl:"/cgi-bin/webif/" intitle:"WEBIF"  
  
___________________  
|| 0x05: RISK LEVEL  
  
- LOW - (1/3) -  
  
<!> Happy Hacking <!>  
  
____________________________________________________________  
____________________________________________________________  
  
THE END  
  
`