Secure Science Corporation Application Software Advisory 055

2005-04-21T00:00:00
ID SECURITYVULNS:DOC:8402
Type securityvulns
Reporter Securityvulns
Modified 2005-04-21T00:00:00

Description

Secure Science Corporation Advisory ASA-055 http://www.securescience.net e-response@securescience.net 877-570-0455


PHPROJEKT 4.2 Chatroom is vulnerable to Cross-Site Scripting (XSS) attacks allowing a "broadcast" attack to users in the chatroom.


Vulnerability Classification: Cross-Site Scripting, Arbitrary browser control, "broadcast" attack.

Discovery Date: April 10, 2005 Vendor Contacted: April 14, 2005 Advisory publication date: April 20, 2005

Abstract:

PHPROJEKT <= 4.2 allow XSS attacks in the chatroom via the text submission form. This enables all viewers of the chat present and future to be exploited via arbitrary commands inputted via the attacker. Such attacks "broadcast" every 20 seconds based on the "refreshing" of content and set static in the chatroom html.

Description:

During a recent evaluation of PHPROJEKT 4.2, the chatroom text submission was found to allow html tags including "<>" thus enabling a XSS attack against users in the chatroom. The nature of a chatroom allows all parties to see live messages publicly in "real time" so an XSS attack will be broadcasted to all users receiving messages. Also noted is that the chat forum holds static content for users to come back and review the messages. Essentially if a user decides to enter the targeted chatroom, the XSS attack will successfully execute immediately whether or not there is a live chat session in progress.

The ease of attack is implemented merely from typing your attack in the test submission form and waiting for a refresh to occur. Once this is performed, arbitrary code that was submitted by the user will be executed and sent to all viewing browsers.

Tested Vendors:

PHPROJECT 4.2

Vendor and Patch Information:

Secure Science Corporation has submitted this to PHPROJEKT and has received no response to date. Due to the importance of the situation it has been posted to bugtraq.

Solution:

Require input validation on unnecessary fields.

Credits:

Secure Science Corporation

Disclaimer:

Secure Science Corporation is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Secure Science Corporation products.