Upload Vulnerability and XSS in socialware V2.2 (www.iscripts.com)

vendor:

iScripts SocialWare

by:

Sid3^effects

6,4

CVSS

MEDIUM

Upload Vulnerability and XSS

CWE

Product Name: iScripts SocialWare

Affected Version From: V2.2

Affected Version To: V2.2

Patch Exists: NO

Related CWE: N/A

CPE: a:iscripts:socialware:2.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Web Application

2010

Upload Vulnerability and XSS in socialware V2.2 (www.iscripts.com)

Create your own social community in minutes by using iScripts SocialWare. You can add a community to your existing web site or a standalone web 2.0 application. This script will allow you to create online networking communities for small groups like school classes, regional groups and others. It can also be used for the purposes of professional networking or romantic networks. By allowing your users to network with their family and friends, you are driving viral traffic to your site. The exploit involves registering in the site, going to the profile page, opening the 'ADD WIDGETS' option and uploading the evil script. The XSS vulnerability is present in the search query parameter.

Mitigation:

Input validation and output encoding should be used to prevent XSS attacks.

Source

Exploit-DB raw data:

# Exploit Title:Upload Vulnerability and XSS in socialware V2.2 (www.iscripts.com)
# Version: Web Application
# vendor :www.iscripts.com
# Date: 29 apr,2010
# Dork:Powered by iScripts SocialWare
# Author:Sid3^effects
# Code :
--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r,41.w4r10r     
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
 
Description :
Create your own social community in minutes by using iScripts SocialWare. You can add a community to your existing web site or a standalone web 2.0 application. This script will allow you to create online networking communities for small groups like school classes, regional groups and others. It can also be used for the purposes of professional networking or romantic networks. By allowing your users to network with their family and friends, you are driving viral traffic to your site.

############################################################################

Xploit : Upload Vulnerability

       
  Step 1:Register in the site 
  
  Step 2:Goto your www.site.com/profile.php 
   
  Step 3:Open the "ADD WIDGETS option"
 
         DEMO URL :http://[site]/socialware/demo/includes/profile_save_widgets.php
  
  Step 4:By uploading the evil script successfully u can attack the site :)


############################################################################

Xploit : XSS Vulnerability
  
    Attack parameter :'"--><script>alert(0x000872)</script> 
    Parameter Type : Search query 
    DEMO URL :   
  		http://server/socialware/demo/album.php 
   

############################################################################

#Sid3^effects