ZenPhoto 1.4.0.3 – x-forwarded-for HTTP Header Persistent Cross-Site Scripting - 体验盒子

作者： Saif

日期： 2011-04-22

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/17200/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

# Exploit Title: ZenPhoto 1.4.0.3 patched 2011-4-19 x-forwarded-for HTTP

Header presisitent XSS

# Date: 21-4-2011

# Author: Saif El-Sherei

# Software Link: http://zenphoto.googlecode.com/files/zenphoto-1.4.0.3.zip

# Version: 1.4.0.3 latest updated 2011-4-19

# Tested on:FF 3.0.15, IE 8

Info:

Zenphoto is an answer to lots of calls for an online gallery solution that

just makes sense. After years of bloated software that does everything and

your dishes, zenphoto just shows your photos, simply. It's got all the

functionality and "features" you need, and nothing you don't. Where the old

guys put in a bunch of modules and junk, we put a lot of thought. We hope

you agree with our philosopy: simpler is better.

Details:

failure to sanitize "x-forwarded-for" HTTP header in security logs before

being displayed in "zp-core/admin-logs.php", could allow a remote attacker

to inject malicious HTML code by altering the "x-forwarded-for" HTTP header

using either an intercepting proxy or manual requests in security logs and

attack any user with sufficient privilege to access "Security-logs", usually

appliaction administrators by presistent XSS.

POC:

Regards,

Saif El-Sherei