logo Home

Untitled Document
Security Corporation Security Advisories


Untitled Document .: Multiple Cross Site Scripting Vulnerabilities in Nuked-Klan :.

________________________________________________________________________

Security Corporation Security Advisory [SCSA-003]
________________________________________________________________________

PROGRAM: Nuked-Klan
HOMEPAGE: http://www.nuked-klan.org
VULNERABLE VERSIONS: beta 1.2 and prior
________________________________________________________________________


DESCRIPTION
________________________________________________________________________

Nuked Klan is a PHP Gateway for "clans".

(direct quote from Nuked Klan website)


DETAILS & EXPLOITS
________________________________________________________________________

Many Cross-Site Scripting vulnerabilities have been found in Nuked Klan
which allow attackers to inject script codes into the page and use them
on clients browser as if they were provided by the site.


These Cross-Site Scripting vulnerabilities are found in the following
modules : Guestbook, Forum, Shoutbox.

An attacker can input specially crafted links and/or other
malicious scripts.


Guestbook
________________________________________________________________________

A vulnerability was discovered in the page for posting messages,
at this adress :

http://[target]/index.php?file=Guestbook&req=post_book


The vulnerability is at the level of the interpretation of the "Author"
field.

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator
of the visitors.


The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)

Forum
________________________________________________________________________

A vulnerability was discovered in the page for posting new messages in
the forum, at this adress :

http://[target]/index.php?file=Forum&op=post_screen&forum_id=0

The vulnerability is at the level of the interpretation of the "Titre"
and "Pseudo" field.

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator
of the visitors.

The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)

Shoutbox
________________________________________________________________________

A vulnerability was discovered in the page for posting messages
in "La Tribune Libre".

Indeed, the insertion of a hostile code script in this field makes it
possible to a malicious user to carry out this script on the navigator
of the visitors.

The hostile code could be :

[script]alert("Cookie="+document.cookie)[/script]

(open a window with the cookie of the visitor.)

(replace [] by <>)


-------Vulnerable line in submit.php--------

$shout = str_replace("|","",$SB_text);

--------------------------------------------


Possible solutions: modify the code in order to analyze the whole of
the text sent by the user and to replace the hostile elements.


---------------Code example-----------------
<?
$SB_text = str_replace("<", "[", $SB_text);
$SB_text = str_replace(">", "]", $SB_text);
$SB_text = htmlentities($SB_text);
$shout = str_replace("|","",$SB_text);
?>
--------------------------------------------


SOLUTIONS
________________________________________________________________________

Upgrade your version to beta 1.3


Upgrade Guestbook with the appropriate patch :
http://tomysnockers.net/download/Guestbook.rar

Upgrade Shoutbox with the appropriate patch :
http://www.nuked-klan.org/files/Shoutbox_13.zip

VENDOR STATUS
________________________________________________________________________

The vendor has reportedly been notified


LINKS
________________________________________________________________________

http://www.security-corp.org/index.php?ink=4-15-1


------------------------------------------------------------
Grégory Le Bras aka GaLiaRePt | http://www.Security-Corp.org
------------------------------------------------------------



arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy