[UNIX] DCP-Portal Cross-Site Scripting
From: support@securiteam.comDate: 02/17/02
- Previous message: support@securiteam.com: "[NEWS] Web Browsers Ignore Content-Type Headers Allowing Cross-site Scripting"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Sun, 17 Feb 2002 00:16:39 +0100 (CET)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
DCP-Portal Cross-Site Scripting
------------------------------------------------------------------------
SUMMARY
<http://www.dcp-portal.com> DCP-Portal is a content management system
with advanced features like web-based update, link, file, member
management, poll, calendar, etc. Its main features include an admin panel
to manage the entire site, a smart HTML editor to add news, content, and
announcements, the ability for members to submit news/content and write
reviews, and much more. It is an open-source project, which is also
supported by FreshMeat. A security vulnerability in the product allows
remote attackers to exploit a Cross-site scripting vulnerability in the
product.
DETAILS
Vulnerable systems:
DCP-Portal versions 4.2, 4.1 final, 4.0 final, 3.7 and probably prior
Immune systems:
DCP-Portal version 4.5
A Cross Site Scripting vulnerability exists in DCP-Portal. This would
allow a remote attacker to send information to victims from untrusted web
servers, and make it look as if the information came from the legitimate
server.
Details:
The attacker will first register, with probably an alphabetically
first-coming username (eg: aaaaa). After registering, activating and
logging in with the account, he/she would request the Change Details form
"http://www.example.com/user_update.php". There, he/she may change the job
info, inserting arbitrary codes.
Example:
<script>alert("ALPERz was here!")</script>
After applying this information, whenever any logged in member, requests
the members page, this CSS vulnerability will take effect.
This CSS vulnerability might also be exploitable, when a user first
registers.
Solution:
Strip HTML tags, and possibly other malicious code within user_update.php.
ADDITIONAL INFORMATION
The information has been provided by <mailto:s_alper@hotmail.com> Ahmet
Sabri ALPER.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[NEWS] Web Browsers Ignore Content-Type Headers Allowing Cross-site Scripting"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
