Securimage 3.5 URI-based Cross-Site Scripting Vulnerability

🗓️ 10 May 2013 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 40 Views

Securimage 3.5 URI-based Cross-Site Scripting Vulnerability in 'example_form.php'. Attackers can execute arbitrary HTML and script code. Vendor releases version 3.5.1 to address the issue

<html><body><p>Securimage 3.5 URI-based Cross-Site Scripting Vulnerability


Vendor: Securimage PHP CAPTCHA
Product web page: http://www.phpcaptcha.org
Affected version: 3.5

Summary: Securimage is an open-source free PHP CAPTCHA
script for generating complex images and CAPTCHA codes
to protect forms from spam and abuse.

Desc: Securimage suffers from a XSS issue in 'example_form.php'
that uses the 'REQUEST_URI' variable. The vulnerability is
present because there isn't any filtering to the mentioned
variable in the affected script. Attackers can exploit this
weakness to execute arbitrary HTML and script code in a user's
browser session.

---------------------------------------------------------------
/example_form.php:
------------------

47: </p><form action="&lt;?php echo $_SERVER['REQUEST_URI'] . $_SERVER['QUERY_STRING'] ?&gt;" id="contact_form" method="post">

---------------------------------------------------------------


Tested on: Apache, PHP 5.3.6


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience



Advisory ID: ZSL-2013-5139
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5139.php


21.04.2013

--


http://localhost/securimage/example_form.php/"/&gt;<script>alert(document.cookie)</script>
</form></body></html>

10 May 2013 00:00Current

6.1Medium risk

Vulners AI Score6.1