Imageshack.us Cross Site Scripting

`By SecWorm.net - Cross Site Scripting vulnerability in Imageshack.us  
  
  
  
SecWorm.net - Advisory  
http://Secworm.net/  
Cross Site Scripting [XSS] issue in Imageshack.us  
  
--------------------------------------------------------------  
1. Advisory Information:  
--------------------------------------------------------------  
Title:- Cross Site Scripting vulnerability in Imageshack.us  
Advisory ID:- SecWormNetwork-2009-1  
Advisory URL:- http://secworm.net/showthread.php?tid=23  
  
--------------------------------------------------------------  
2. Vulnerability Information:  
--------------------------------------------------------------  
Class:- Cross Site Scripting  
Remotely Exploitable:- Yes  
Locally Exploitable:- Yes  
  
PATCHED :- NO [not as if now].  
  
--------------------------------------------------------------  
3. Vulnerability Description:  
--------------------------------------------------------------  
When uploading multiple images, website redirects to an album information  
page which is vulnerable to cross site scripting. The URL can be modified to  
execute javascript within the security context of the imageshack.us domain.  
This can be used to hijack user's cookies and thus their authenticated  
sessions.  
  
--------------------------------------------------------------  
4. POC [Proof of Concept]:  
--------------------------------------------------------------  
http://img6.imageshack.us/gal.php?g=%3Cs.../script%3E  
<http://img6.imageshack.us/gal.php?g=%3Cscript%3Ealert%28document.cookie%29%  
3C/script%3E>   
Screenshot:- http://secworm.net/poc/secwormnetwork-2009-1.jpg  
--------------------------------------------------------------  
5. Credits:  
--------------------------------------------------------------  
This vulnerability was discovered by Nishant Soni (brainst0rm) from SecWorm  
Network.  
  
--------------------------------------------------------------  
6. Report Timeline:  
--------------------------------------------------------------  
15th December 2009 - Nishant Soni from SecWorm Network leaves an Email from  
"Contact Us" page at Imageshack.us  
15th December 2009 - Nick from Imageshack.us replies to Nishant's email  
requesting vulnerability disclosure.  
15th December 2009 - Nishant Soni reveals the vulnerability information to  
Nick.  
Further Reply Awaited.  
  
--------------------------------------------------------------  
7. About SecWorm Network:  
--------------------------------------------------------------  
SecWorm Network is a group of Security Researchers & Ethical hackers with  
the motto of security awareness and helping others to secure themselves.  
Everyone can reach to us at http://www.SecWorm.net/  
  
--------------------------------------------------------------  
8. Disclaimer & Copyright:  
--------------------------------------------------------------  
The contents of this advisory are copyright C 2009 SecWorm Network, and may  
be distributed freely provided that and proper credit is given.  
  
  
  
Thanks & Regards,  
  
Nishant Soni (brainst0rm).  
  
  
  
`