[34325] in bugtraq
phpkit suffers (reale stupid) XSS vuln.
daemon@ATHENA.MIT.EDU (Yanosz)
Tue Mar 30 16:22:51 2004
From: Yanosz <yanosz@gmx.net>
To: bugtraq@securityfocus.com
Date: Tue, 30 Mar 2004 21:52:39 +0200
Cc: henrik.schott@phpkit.de, webmaster@phpkit.de
MIME-Version: 1.0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200403302152.39469.yanosz@gmx.net>
Software: phpkit
Version: 1.6.03 others are probably affected as well.
Status: Vendor has been notified weeks ago but refuses to answer or take any
actions.
phpkit[1] is a simple German cms / portal software written in php similar to
phpbb / phpnuke and is quite popular in Germany. All session information is
stored in cookies - thus a attacker can easily steal session data or hashed
passwords.
The forum part has _no_ protection against JavaScript, Object or Java
injections - all html-tags appear in the victim's browser.
Proof-of-concept code
That's odd - <script... ;)
The source also seems to be vulnerably to SQL-injections - good luck ;)
Workaround:
Don't use this software. These guys do not seem to know what they are doing.
Keep smiling
yanosz
[1]http://www.phpkit.de
