[32049] in bugtraq
TRACKtheCLICK Script Injection Vulnerabilities
daemon@ATHENA.MIT.EDU (BrainRawt)
Sat Oct 11 14:51:35 2003
From: "BrainRawt" <brainrawt@haxworx.com>
To: <bugtraq@securityfocus.com>
Date: Sat, 11 Oct 2003 01:32:25 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <Law10-OE12uk4RFfJV3000013d1@hotmail.com>
Scripts4webmasters.com TRACKtheCLICK Script Injection Vulnerabilities
Discovered By Chris Rahm (aka: BrainRawt) (brainrawt@haxworx.com)
About TRACKtheCLICK:
--------------------
A perl coded CGI that tracks your email, ezine, banner, and web site
links. TRACKtheCLICK outputs log information to a data file that in
return is viewable in an organized HTML format through the use of
another CGI called admin.cgi.
TRACKtheCLICK can be downloaded from the following address.
http://www.scripts4webmasters.com/clicktracking/index.shtml
Vulnerable Version:
-------------------
Version 1.0
Vendor Contact:
----------------
10-5-03 - Emailed webmaster@scripts4webmasters.com
10-10-03 - No Response
Vulnerability:
----------------
Due to a lack of filtering in click.cgi, scalars $agent and $referer are
vulnerable to script injection. An individual can inject malicious code
to the data file by spoofing their User-Agent: and/or Referer:. When the
data file is opened by admin.cgi, the injected code will be executed by
that persons browser.
--------------------------------------------------------------------------
