46 lines
No EOL
2.5 KiB
Text
46 lines
No EOL
2.5 KiB
Text
1. +-----------------+-----------------+-----------------+
|
|
2. +-----------------+Fresh Email Script+----------------+
|
|
3. +-----------------versions: 1.0 to 1.11 - all
|
|
4. +-----------------exploits: file inclusion & cookie manipulation
|
|
5. +-----------------founder: Don
|
|
6. +-----------------date: November 10. 2008
|
|
7. +-----------------+-----------------+-----------------+
|
|
8. +homepage: http://www.freshscripts.net/index.php?do=catalog&c=featured_scripts_!&i=fresh_email_script
|
|
9. +vendor notified ? / no
|
|
10. +-----------------+-----------------+-----------------+
|
|
11. +[1]
|
|
12. +file inclusion+
|
|
13. +found in /url.php?tmp_sid=
|
|
14. +so like site[dot]com/url.php?tmp_sid=[]
|
|
15. +attack description:
|
|
16. +The GET variable tmp_sid has been set to http://site[dot]com/some_inexistent_file_with_long_name.
|
|
17. +It is possible for a remote attacker to include a file from local or remote resources and
|
|
18. +or execute arbitrary script code with the privileges of the web server.
|
|
19. +-----------------+-----------------+-----------------+
|
|
20. +[2]
|
|
21. +cookie manipulation+
|
|
22. +found in register.php
|
|
23. +By injecting a custom HTTP header or by injecting a META tag,
|
|
24. +it is possible to alter the cookies stored in the browser.
|
|
25. +Attackers will normally manipulate cookie values to fraudulently authenticate themselves on a web site.
|
|
26. +By exploiting this vulnerability, an attacker may conduct a session fixation attack.
|
|
27. +In a session fixation attack, the attacker fixes the user's session ID before the user even logs into the target server,
|
|
28. +thereby eliminating the need to obtain the user's session ID afterwards.
|
|
29. +-----------------+-----------------+-----------------+
|
|
30. +vuln:
|
|
31. +Email=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&Password=1230321email@address.com®ister=Register
|
|
32. +-----------------+-----------------+-----------------+
|
|
33. +How to fix this vulnerability+
|
|
34. +
|
|
35. +You need to filter the output in order to prevent the injection of custom HTTP headers or META tags.
|
|
36. +Additionally, with each login the application should provide a new session ID to the user.
|
|
37. +-----------------+-----------------+-----------------+
|
|
38. +greetz to all of my friends
|
|
39. +special greetz to milw0rm as well as str0ke!+
|
|
40. +
|
|
41. +
|
|
42. +~#Don 2008
|
|
43. +Serbian security analyzer
|
|
44. +-----------------+-----------------+-----------------+
|
|
|
|
# milw0rm.com [2008-11-10] |