|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 6876 CVE : CVE-2009-4422 CWE : CWE-79 SecurityRisk : Low  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : Yes Exploit Available : No Credit : Martin Barbella Published : 26.12.2009
Advisory Content : XSS Vulnerability in JpGraph 3.0.6 Discovered by Martin Barbella <barbella (at) sas.upenn (dot) edu [email concealed]> Description of Vulnerability: ----------------------------- JpGraph is an object oriented library for PHP that can be used to create various types of graphs which also contains support for client side image maps. The GetURLArguments function for the JpGraph's Graph class does not properly sanitize the names of get and post variables, leading to a cross site scripting vulnerability. Systems affected: ----------------- This has been confirmed in version 3.0.6 of JpGraph's free release. Previous versions and the professional versions may be affected as well. Impact: ------- When a user is tricked into clicking on a malicious link or submitting a specially crafted form, the injected code travels to the vulnerable web server, which reflects the attack back to the userâ??s browser. The browser then executes the code because it came from a "trusted" server. (From OWASP: http://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29) Mitigating factors: ------------------- The vulnerability seems to be exploitable only in cases where client side image maps are used. Proof of concept: ----------------- This can be demonstrated in the csim_in_html_ex1.php example provided with jpgraph (as well various other csim examples) as shown below. http://site/csim_in_html_ex1.php?"/><script>alert('XSS')</script>=arbitr ary Solution: --------- The following patch can be applied to jpgraph.php to correct the vulnerability. --- jpgraph.php.orig 2009-11-14 14:45:01.000000000 -0500 +++ jpgraph.php 2009-11-14 14:55:34.000000000 -0500 @@ -1286,11 +1286,11 @@ while( list($key,$value) = each($_GET) ) { if( is_array($value) ) { foreach ( $value as $k => $v ) { - $urlarg .= '&'.$key.'%5B'.$k.'%5D='.urlencode($v); + $urlarg .= '&'.urlencode($key).'%5B'.urlencode($k).'%5D='.urlencode($v); } } else { - $urlarg .= '&'.$key.'='.urlencode($value); + $urlarg .= '&'.urlencode($key).'='.urlencode($value); } } @@ -1301,11 +1301,11 @@ while( list($key,$value) = each($_POST) ) { if( is_array($value) ) { foreach ( $value as $k => $v ) { - $urlarg .= '&'.$key.'%5B'.$k.'%5D='.urlencode($v); + $urlarg .= '&'.urlencode($key).'%5B'.urlencode($k).'%5D='.urlencode($v); } } else { - $urlarg .= '&'.$key.'='.urlencode($value); + $urlarg .= '&'.urlencode($key).'='.urlencode($value); } } References : http://www.securityfocus.com/archive/1/archive/1/508586/100/0/threaded
http://secunia.com/advisories/37832
http://osvdb.org/61268  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Allow attacker to denial of service apache 2.2.17 server |
||
| Apache |  |
|
| PHP | |
|
» libzip 0.9.3 |
||
| ADT | ||
Protect your family and valuables with Home Security Systems |
||
- 2011-05-13| Copyright © SecurityReason.com. All Rights Reserved. |