[SCSA-013] Cross Site Scripting vulnerability in testcgi.exe

From: Grégory (gregory.lebras@security-corporation.com)
Date: 03/27/03

  • Next message: Martin Schulze: "[SECURITY] [DSA 270-1] New Linux kernel packages (mips + mipsel) fix local root exploit" 
    Date: 27 Mar 2003 14:38:05 -0000
From: "Grégory" Le Bras <gregory.lebras@security-corporation.com>
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    ________________________________________________________________________

    Security Corporation Security Advisory [SCSA-013]
    ________________________________________________________________________

    PROGRAM: Ceilidh
    HOMEPAGE: http://www.lilikoi.com
    VULNERABLE VERSIONS: 2.70 and prior
    ________________________________________________________________________

    DESCRIPTION
    ________________________________________________________________________

    "Ceilidh is a Web-based threaded discussion engine that features
    automatic text to HTML conversion, file attachment, e-mail
    notification, automatic message expiration, multiple levels of
    security and much more."
    (direct quote from http://www.lilikoi.com)

    DETAILS & EXPLOITS
    ________________________________________________________________________

    ¤ Cross Site Scripting :

    A exploitable bug was found on Ceilidh which cause script
    execution on client's computer by following a crafted url.

    This kind of attack known as "Cross-Site Scripting Vulnerability" is
    present in testcgi.exe file, an attacker can input specially crafted
    links and/or other malicious scripts.

    - Exploits :

    http://[target]/cgi-bin/testcgi.exe?[hostile_code]

    The hostile code could be :

    [script]alert("Cookie="+document.cookie)[/script]

    (open a window with the cookie of the visitor.)

    (replace [] by <>)

    SOLUTIONS
    ________________________________________________________________________

    No solution for the moment.

    VENDOR STATUS
    ________________________________________________________________________

    The vendor has reportedly been notified.

    LINKS
    ________________________________________________________________________

    - http://www.security-corp.org/index.php?ink=4-15-1

    - Version Française :
    http://www.security-corporation.com/index.php?id=advisories&a=013-FR

    ------------------------------------------------------------------------
    Grégory Le Bras aka GaLiaRePt | http://www.Security-Corporation.com
    ------------------------------------------------------------------------

  • Next message: Martin Schulze: "[SECURITY] [DSA 270-1] New Linux kernel packages (mips + mipsel) fix local root exploit"

    Relevant Pages