logo Home

Untitled Document

Home > Archives Advisories > Articles


Untitled Document

Untitled Document

CGI-City's CCLOG Script Injection Vulns
Date: 2003-03-30

Author : BrainRawt . <brainrawt@hotmail.com>

CGI-City's CCLOG USER-AGENT and REFERER Script Injection
Vulnerabilities Discovered By BrainRawt (brainrawt@hotmail.com)

About CCLOG:
------------------
CC Log is a very simple logging script which logs the hits to
a single web page. This script is typically useful for logging
the hits to the main index page. It collects information like
date and time of the hit, browser agent used by the visitor,
host IP addresses, and HTTP referrer whenever available. The
script logs everything on to an HTML log file which the user
can easily view under any browser. This script requires SSI.

CCLOG can be downloaded from the following address.

http://www.icthus.net/CGI-City/scr_cgicity.shtml#CCLOG


Vendor Contact:
----------------
1-30-03 Emailed cgicity@icthus.net

No Response

Vulnerability:
----------------
CCLOG's cc_log.pl lacks filtering of any data coming in from the
remote host. This data in return is redirected to an html. Due
to the lack of input filters, a malicious visitor could inject
scripting into that html by falsifying the USER-AGENT and/or the
REFERER. This attack would result in the execution of the
injected script by anyones browser that views the html.


Exploit (POC):
----------------
User-Agent: <script>alert('obvious?')</script>
Referer: <script>alert('obvious?')</script>





 

arrowSearch Advisories

arrowNewsletter

Free weekly Newsletter.

Please enter your email address here:
arrowReport Vulnerability

If you've found a vulnerability please
click here to report it.
arrowPartners

newsnow

About Us | Contact Us | Advertise | email | Backend flag
Copyright © 2016-2017 Security Corporation - All Rights Reserved - Legal - Privacy Policy