LifeType 1.2.10 – HTTP Referer Persistent Cross-Site Scripting

• Exploit Database
• 117 阅读

• 作者： Saif El-Sherei
  日期： 2011-01-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/15981/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

  # Exploit Title: lifetype 1.2.10 http referer XSS # Date: 11-1-2010 # Author: Saif El-Sherei # Software Link: http://lifetype.net/page/downloads # Version: 1.2.10 # Tested on: firefox 3.0.15   failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins or any user able to view blog statistics. an attacker could use an intercepting proxy or manual requests to perform this attack, the referer is recorder into the database when visiting any section in the index.php (albums, archives,etc....), a user with only the privilegeto login could perform this attack, the issue affects all browsers.   POC:   referer HTTP header: http://127.0.0.1/lifetype-1.2.10/index.php?op=Template&blogId=1&show=archives"><script>alert(&apos;XSS&apos;)</script>   timeline:   vulnerability dicovered: 11-1-2011 vendor notified: 11-1-2011