[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [Full-Disclosure] phpkit suffers (realy stupid) XSS vuln.
From:       Yanosz <yanosz () gmx ! net>
Date:       2004-03-30 20:26:19
Message-ID: 200403302152.39469.yanosz () gmx ! net
[Download RAW message or body]

Software: phpkit
Version: 1.6.03 others are probably affected as well.
Status: Vendor has been notified weeks ago but refuses to answer or take any 
actions.
phpkit[1] is a simple German cms / portal software written in php similar to 
phpbb / phpnuke and is quite popular in Germany. All session information is 
stored in cookies - thus a attacker can easily steal session data or hashed 
passwords.

The forum part has _no_ protection against JavaScript, Object or Java 
injections - all html-tags appear in the victim's browser.

Proof-of-concept code
That's odd - <script... ;)

The source also seems to be vulnerably to SQL-injections - good luck ;)

Workaround: 
Don't use this software. These guys do not seem to know what they are doing.

Keep smiling
yanosz

[1]http://www.phpkit.de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
[prev in list] [next in list] [prev in thread] [next in thread]