lifetype 1.2.10 http referer XSS

vendor:

lifetype

by:

Saif El-Sherei

4.3

CVSS

MEDIUM

Cross-site Scripting (XSS)

CWE

Product Name: lifetype

Affected Version From: 1.2.10

Affected Version To: 1.2.10

Patch Exists: YES

Related CWE: N/A

CPE: lifetype

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox 3.0.15

2010

lifetype 1.2.10 http referer XSS

Failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins or any user able to view blog statistics. An attacker could use an intercepting proxy or manual requests to perform this attack, the referer is recorder into the database when visiting any section in the index.php (albums, archives,etc....), a user with only the privilege to login could perform this attack, the issue affects all browsers.

Mitigation:

Sanitize the http referer header in index.php.

Source

Exploit-DB raw data:

# Exploit Title: lifetype 1.2.10 http referer XSS
# Date: 11-1-2010
# Author: Saif El-Sherei
# Software Link: http://lifetype.net/page/downloads
# Version: 1.2.10
# Tested on: firefox 3.0.15

failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins or any user able to view blog statistics. an attacker could use an intercepting proxy or manual requests to perform this attack, the referer is recorder into the database when visiting any section in the index.php (albums, archives,etc....), a user with only the privilege  to login could perform this attack, the issue affects all browsers.

POC:

referer HTTP header: http://127.0.0.1/lifetype-1.2.10/index.php?op=Template&blogId=1&show=archives"><script>alert('XSS')</script>

timeline:

vulnerability dicovered: 11-1-2011
vendor notified: 11-1-2011