MagpieRSS XSS 0day

Hello,

I have found a Cross Site Scripting vulnerability in MagpieRSS, an RSS parser written in PHP, basically, this piece of software enables users to add their own RSS feeds to be parsed, so they can keep up to date with their favourite feeds, as well as the pre-defined ones.

I crafted my own RSS feed, which contains XSS inside the CDATA.

Here is the XML file I used: http://www.elites0ft.com/poc.xml

If for example, I ask a user to subscribe to my feed, after disguising it as a real feed, I then go and update it with malicious content, the RSS parser will then parse the updated content and the user will end up loading an Iframe with a cookie stealer inside.

The reason this happens is because the CDATA is not getting escaped, it is a simple fix: htmlentities() around the parsed CDATA.

This is a potentially harmful exploit if you can convince users to add your feed.

Thanks for reading,
system_meltdown.
[Elites0ft.com]