Digsby Persistent Xss and DOS Vulnerability

===========================================
Digsby Persistent Xss and DOS Vulnerability
===========================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
3                                                                      3
3             _     __       __    ________     __  __                 3
7           /' \  /'__`\   /'__`\ /\_____  \   /\ \/\ \                7
1          /\_, \/\_\L\ \ /\_\L\ \\/___//'/'   \_\ \ \ \____           1
3          \/_/\ \/_/_\_<_\/_/_\_<_   /' /'    /'_` \ \ '__`\          3
3             \ \ \/\ \L\ \ /\ \L\ \ /' /'    /\ \L\ \ \ \L\ \         3
7              \ \_\ \____/ \ \____//\_/      \ \___,_\ \_,__/         7
1               \/_/\/___/   \/___/ \//        \/__,_ /\/___/          1
3              >> Exploit database separated by exploit                3
3                     type (local, remote, DoS, etc.)                  3
7                                                                      7
1          [+] Site            : 1337db.com                            1
3          [+] Support e-mail  : submit[at]1337db.com                  3
3                                                                      3
7             ###############################################          7
1             I'm Sid3^effects 1337 Member from 1337 DataBase          1
3             ###############################################          3
3                                                                      3                                            
7-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-7


Name : Digsby Xss and DOS Vulnerability
Date : Nov,20 2010
Vendor Url :http://www.digsby.com/
Critical: LESS
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
Big hugs : Th3 RDX,Hanan_butt,
special thanks to : r0073r (1337db.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
            tranquiller
Msg to all : V r not dead !!! we will be back soon!!
             Let the kids play when their dads out ;)
greetz to :!Op3x_ninjato team,www.topsecure.net ,trent Dillman,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
About Digsby:
    digsby is a multiprotocol IM client that lets you chat with all your friends on AIM, MSN,
    Yahoo, ICQ, Google Talk, and Jabber with one simple to manage buddy list.

###############################################################################################################
Description:

Digsby maintains the chat logs(html format) in a particular folder named "Digsby Logs".
Navigate to your profile log and edit any of the chat log and insert a xss script and save the log.

For example : <script>alert("D0Nt be so happy!!W3 are coming soon")</script>

example : C:\Documents and Settings\leet\My Documents\Digsby Logs\your_digsby_username\yahoo\Your_email\your_friend's_chatlog

Now Login to digsby and select Tools-->Chat History-->Select the profile and open the particular chat log which has been
edited and you must be getting the javascript alert which ultimately crashes the application.

###############################################################################################################
Screenshots:
http://img404.imageshack.us/img404/9320/digsxss.jpg (Persistent xss)

http://img225.imageshack.us/img225/9407/digsbydosed.jpg (Application crashed)

###############################################################################################################
Fix:
   N/a
###############################################################################################################
# 0day no more
# Sid3^effects 



#  0day.today [2018-01-08]  #