Home page logo
/

bugtraq logo Bugtraq mailing list archives

PHP Live! 3.2.2 Multiple Cross-Site Scripting Vulnerabilities
From: DoZ () HackersCenter com
Date: 25 Dec 2006 19:21:36 -0000

PHP Live! (© OSI Codes Inc.) enables live help and live customer support communication directly from your website. With 
PHP Live!, you can provide one-on-one chat assistance in real-time, answer visitor questions and add that extra human 
touch to your website. The application if full of xss holes inside the Admin Panel and chat system its self. An 
attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the 
context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other 
attacks.


PHP Live! 3.2.2 Multiple Cross-Site Scripting Vulnerabilities


Hackers Center Security Group (http://www.hackerscenter.com)

Credit: Doz


Risk: Medium to High


Vendor: www.phplivesupport.com/

Class: Cross-Site Scripting

Remote: Yes

Local:  Yes

Free Trial: www.phplivesupport.com/trial.php

Versions: 3.2.2 & older versions maybe effected.

Exploit: An attacker can exploit these issues via a web client.

XSS example: 

Local:

/transcripts.php?action=view&deptid=1&userid=0&search_string=[XSS]

or

http://PHP Live Site.com/index.php?l=[XSS]

or

http://PHP Live Site.com/phplive/index.php (login XSS)
               

Remote:

/phplive/message_box.php?theme=&l=ezpub&x=1&deptid=[XSS]

or

/phplive/message_box.php?theme=&l=admin&x=[XSS]


Solution: Filter out characters that invite XSS attacks.


  By Date           By Thread  

Current thread:
  • PHP Live! 3.2.2 Multiple Cross-Site Scripting Vulnerabilities DoZ (Dec 25)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]