Eggblog v3.1.0 XSS Vulnerability

Advisory Text :

H - Security Labs

Eggblog v3.1.0 Security Advisory

ID : HSEC#20071111

General Information

--------------------------

Name : EggBlog v.3.1.0

Vendor HomePage :http://sourceforge.net/projects/eggblog/

Platforms : PHP && MySQL

Vulnerability Type : Input Validation Error

Timeline

-------------------------

08 October 2007 -- Vendor Contacted

30 October 2007 -- Vendor Replied

11 November 2007 -- New Release

11 November 2007 -- Advisory Released

What is Eggblog

------------------------

eggblog is a free PHP & MySQL blogging package. Features include an
internal search engine,

photo albums, forums, plug-ins, guest comments to blog articles, automatic
monthly archiving

of blog articles and RSS XML feeds for both the blog and forums.

I discovered the security holes when I was testing it for my personel web
blog.

Vulnerability Overview

------------------------

The script is vulnerable to XSS attacks.

Details About Vulnerability

------------------------

XSS Vulnerability(home/rss.php)

At the rss.php line 6-7; there are unfiltered PHP_SELFs that can be used
for XSS attacks.

---------

<a

href="../rss/blog.php">".$_SERVER['SERVER_NAME'].str_replace("/home/rs
s.php","",$_SERVER['

PHP_SELF'])."/rss/blog.php</a></li>

<a

href="../rss/topics.php">".$_SERVER['SERVER_NAME'].str_replace("/home/
rss.php","",$_SERVER

['PHP_SELF'])."/rss/topics.php</a></li>

---------

The attacker can succesfully launch XSS attacks with loading payload on to
the URL after the

homerss.php. For example :

http://www.example.com/home/rss.php/<script>alert(1)</script>

Solutions

-----------------------

Download the new release : EggBlog v3.1.1

Credits

-----------------------

The vulnerabilities found on 08 October 2007

by Mesut Timur <mesut (at) h-labs (dot) org [email concealed]>

H - Security Labs , http://www.h-labs.org

Gebze Institue of Technology,Computer Engineering,http://www.gyte.edu.tr

References

-----------------------

http://sourceforge.net/forum/forum.php?forum_id=753622

http://www.eggblog.net

http://sourceforge.net/projects/eggblog/

Original Advisory :
http://www.h-labs.org/blog/2007/11/11/eggblog_v3_1_0_xss_issues.html

Mesut TIMUR

http://www.h-labs.org

H - Security Labs Güvenlik Editörü

GYTE Bilgisayar Mühendisligi

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Eggblog v3.1.0 XSS Vulnerability