##################################### # CHT Security Research Center-2004 # # http://www.CyberSpy.Org # # Turkey # ##################################### Software: CoolPHP Web Site: http://cphp.sourceforge.net/ Affected Version(s): 1.0-stable Description: CoolPHP is a PHP based portal system.It requires A Web server with PHP>=PHP4 support and MySQL. It's compatible with *NIX and NT. Multiple Vulnerabilities in CoolPHP: Cross-Site Scripting vulnerability: CoolPHP is vulnerable to cross-site scripting attacks. It is possible to construct a link containing arbitrary script code to a website running CoolPHP. When a user browses the link, the script code will be executed on the user's browser. This vulnerability occurs due to insufficient inspection of some user-supplied input. As a result of this deficiency an attacker may exploit the vulnerability by creating a specially crafted URL that includes malicious HTML code as URI parameters for index.php Examples: http://[victim]/index.php?op=buscar&query=<script language=javascript>window.alert(document.cookie);</script> http://[victim]/index.php?op=buscar&query=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E http://[victim]/index.php?op=userinfo&nick=<script language=javascript>window.alert(document.cookie);</script> Path Disclosure Vulnerability: CoolPHP is prone to a path disclosure vulnerability. Passing invalid value for the 'op' URI parameter to the index.php file will cause an error message to be displayed which contains physical path information. This information could be useful in further attacks against the system. Demonstration: http://[victim]/cphp/index.php?op=invparam Local file include Vulnerability with Directory Traversal : CoolPHP does not filter dot dot slash (../) sequences from web requests. This problem may allow an attacker to access known files outside the server root directory and will permit a local attack to include malicious PHP scripts from another local paths. Examples: http://[victim]/index.php?op=../../../../anotheruser/evilfile or as URL encoded format: http://[victim]/index.php?op=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fanotheruser/evilfile ---- Reported By R00tCr4ck at October,16 2004 root(at)CyberSpy.Org Original Article can be found at: http://www.CyberSpy.Org
This archive was generated by hypermail 2.1.3 : Sun Oct 17 2004 - 10:43:12 PDT