[Full-disclosure] Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by Daronet Internet Solutions

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by
Daronet Internet Solutions
Discovered Date: 29/01/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.daronet.co.il

Details:

Daronet Internet Solutions website platform is prone to a Cross Site
Scripting Vulnerability.
The vulnerability exists in "ViewImage.asp" file, caused by the lack of
Input Validation/Filtering
of quotation and HTML characters in the GET parameter "Image".
The use of "ViewImage.asp" is done by "Funclib.js".

Contents of Funclib.js:

…

function fnShowFullImg(sFile) {
window.open("ViewImage.asp?Image="+sFile,"image","top=50,left=50,width="+(screen.availWidth-100)+",height="+(screen.availHeight-100)+",scrollbars");}…After the function is being called, ViewImage.asp prints the following HTMLcode:------------------------------------------------------------------------------------------------------------------…<td style="border: 2px solid #FFFFFF;"><img src="<Unfiltered Input>"style="border: 1px solid #000000;"></td>…Exploitation URL:http://www.example.com/ViewImage.asp?Image=&quot;&gt;your xss code hereSuccessful exploitation may allow execution of script code. This could alsobe exploited to spoof the entire website's content,create fake login menu's for all the platform's users, commit Denial OfService attacks and more…Proof Of Concept:http://www.example.com/ViewImage.asp?Image=&quot;&gt;&lt;script&gt;alert&#40;&#41;&lt;script&gt;To view the full list of vulnerable websites:http://www.daronet.co.il/Index.asp?CategoryID=46&amp;SubjectID=&amp;Page=1Even http://www.2bsecure.co.i
l!
…XSS + Phishing + Social =Daronet Internet Solutions provide an Administration System,that help customers to manage there website by log in to vulnerable XSSpage.The attacker has full access to the retrieved web page just as fake loginpage to the administration system,that cause customer may unintentionally login to attacker fake login page,and send the password of the administration system to the attacker.("hackthe website").http://support.daronet.com/usermanual4.0/ViewImage.asp?Image=">Your XSS codeherehttp://support.daronet.com/basic3/ViewImage.asp?Image=">Your XSS code hereThanks,Tal Argoni, CEHwww.zion-security.com

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/