标题: phpmoneybooks 1.03 Stored XSS 作者: chap0 - chap0.blogspot.com - @_chap0 官网: http://phpmoneybooks.com/ 下载 地址: http://sourceforge.net/projects/phpmoneybooks/files/phpMoneyBooks103.zip/download 影响程序: 1.03 补丁：升级到1.04 程序介绍: phpMoneyBooks is an open sourced php/mysql program. A free alternative to QuickBooks. 摘要： phpmoneybooks 1.03 is vulnerable to Stored XSS vulnerability enabling an attacker to execute arbitrary JavaScript code withing the application. The vulnerability can be utilized when adding a new bank account or customer account. Users other then the admin account are able to input this information which in return can enable the super admin user to fall victim to this attack. The vulnerable index pages reside in /banks/index.php and /customers/index.php. Stored XSS 示例 '><script>alert('XSS')</script> 缺陷代码 www.2cto.com /banks/index.php 40 $_POST[AcctName]=trim($_POST[AcctName]); 41 if(strtolower($row[1])==strtolower($_POST['AcctName'])) { 42 echo "<script type='text/javascript'> 43 alert('Duplicate account: $_POST[AcctName] already exists.'); 44 </script>"; 45 $_GET[action]="AddForm"; /customers/index.php 36 if($_GET[action]=="AddUser"){ 37 $query = "INSERT INTO phpMB_customers (AcctNo,DisplayName, CompanyName,MrMs,FirstName,MiddleIn,LastName,Contact,Phone,Phone2,Fax,Email,Rela tion,BillingAddress,ShippingAddress,Notes) VALUES ('$_POST[AcctNo]', '$_POST[DisplayName]', '$_POST[CompanyName]', '$_POST[MrMs]', '$_POST [FirstName]','$_POST[MiddleIn]', '$_POST[LastName]','$_POST[Contact]', '$_POST[Phone]', '$_POST[Phone2]','$_POST[FAX]','$_POST [Email]', 'Customer','$_POST[BillingAddress]', '$_POST[ShippingAddress]', '$_POST[Notes]')"; 38 QueryMysql($query); 39 $_GET[action]=""; By adding strip_tags to the strings in the php code allows the user input to be sanitized. A couple of other vulnerabilities that exist in this application: Usernames and passwords sent in clear text at log in. The users cookie gets set as username and MD5 password of the user. With this if an attacker inject javascript that steals cookies, the attacker will obtain the users username and MD5 hashed password. These two vulnerabilities are not fix, vendor was notified and is aware.
查看更多关于phpmoneybooks 1.03存储型XSS及修复 - 网站安全 - 自学的详细内容...