advisory-singapore-modern-template.txt

`######################################################################  
#  
# Singapore Modern Template v1.3.2 <= XSS Vulnerability  
#  
# Date : 14-january-2008  
# Vendor URL : http://www.sgal.org  
#  
# Found By : Rubén Ventura Piña (Trew)  
# Contact Info : http://trew.icenetx.net  
# [email protected]  
# ICEnetX Team - http://icenetx.net  
#  
######################################################################  
#  
# Greetings oh earthlings:   
# Ayzax, BRIO, Gaper, (All ICEnetX Team), n3, Tog, ta^3, Paisterist,  
# and to all people who likes H.I.M, lol.  
#  
# "Maybe you can't break the system, but you can always hack it."  
#  
######################################################################  
#  
## Vulnerability ##  
#  
# The "modern template" is the DEFAULT style template in the popular  
# image gallery "Singapore". A vulnerable version of the modern  
# template is included in singapore's latest version (0.10.1).  
#  
# The following code in templates/moden/header.tpl.php (line 11) can  
# be exploited to conduct a XSS attack:  
#  
# <link rel="alternate" type="application/rss+xml"  
# title="'.$sg->pageTitle().'" href="'.$_SERVER["PHP_SELF"]; if  
# (isset($_GET["gallery"])) { echo '?gallery='.$_GET["gallery"];} echo  
# '&template=rss" />  
#  
# Input passed to the "gallery" parameter is not properly santised.  
# Therefore the following request would result in a XSS flaw:  
#  
# http://site.com/[singapore_path]/default.php?gallery="><script>alert(document.cookie);</script>  
#  
# This way an attacker will be able tu execute arbitrary code in a   
# victim's browser by tricking him to follow a malicious link.  
#  
## How to fix ##  
#  
# Change line 11 in "templates/modern/header.tpl.php" to this:  
#  
# <link rel="alternate" type="application/rss+xml"  
# title="'.$sg->pageTitle().'" href="'.$_SERVER["PHP_SELF"]; if  
# (isset($_GET["gallery"])) { echo '?gallery='.htmlspecialchars($_GET["gallery"]);} echo '&template=rss" />  
#  
#  
[EOF]  
`