SecurityvulnsSECURITYVULNS:DOC:24202Pligg Installation File XSS Vulnerability
Title: Pligg Installation File XSS Vulnerability
Vendor: Pligg
Product: Pligg CMS
Tested Version: 1.0.4
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares
===== Description =====
Pligg is prone to a XSS vulnerability in the installation file: install/install1.php. The variable "language"
- obtained from an http request - can be manipulated to execute java script code via onmouseover like
functions. Even with the two sanitizers used (strip_tags and addslashes) it is possible to bypass the double
quote jail of the value field in the input tag by passing a double quote via the "language" variable.
----- install/install1.php -----
20: <input type="hidden" name="language" value="<?php echo addslashes(strip_tags($_REQUEST['language']));
?>">
----- install/install1.php -----
The sanitizer strip_tags prevents new tags to be used (like <script> and </script>) but it does not filter
onmouseover type attacks. Addslashes inserts backslashes to escape special characters like double quote, but
since html does not process escape sequences this sanitizer is useless to prevent breaking the double quote
jail - regardless of magic_quotes is enabled or not.
===== Impact =====
Malicious java script code can be executed in the context of the affected web site.
===== Proof of Concept =====
A simple proof of concept demonstrating the double quote jail by passing is shown below. However, this attack
is not exploitable because the input field is hidden.
http://target/install/install1.php?language=%22%20onmouseover=alert()%3E
To overcome this limitation and provided a real case attack scenario, we used a technique obtained from [1].
This attack attempts to increase the area of the affected input field to cover the whole screen. Once the
mouse is moved anywhere on the screen, the onmouseover java script can be triggered to execute the malicious
code. In this proof of concept, an alert containing the message "XSS" should be shown on the screen in case of
mouse movement.
This attack venue exploited in this proof of concept had no effect on Google Chrome web browser, but was
successfully exploited on Mozilla Firefox and others.
===== Workaround =====
Remove the installation directory after installation, as recommended during installation.
===== Disclosure Timeline =====
June, 16 2010 - Vendor notification.
June, 22 2010 - Vendor replied but did not acknowledge the bug.
June, 22 2010 - New contact attempted to provide more details about the bug.
July, 07 2010 - No vendor reply. Public disclosure.
===== References =====
Hotmail: Powerful Free email with security by Microsoft.
https://signup.live.com/signup.aspx?id=60969