XFileSharing Pro - [BUG] Cross Site Scripting Two found [FIXED]

[spyer]

when you send a message from the contact system.. you'll be redirected to the main page with a message to tell you whether it was a success or failure.

the url is like this http://website.com/?msg=Message sent successfully

but anyone can come and change "Message sent successfully" to whatever they want.

try this... SORRY EZYFILE

Code: Select all

http://www.ezyfile.net/?msg=%3Cscript%3Ealert(%22CROSS SITE SCRIPTING%22)%3C/script%3E

also when sending reports

i'll post them here

Code: Select all

LINE: 446 $ses->redirect("$c->{site_url}/?msg=Message sent successfully");
LINE: 1581 $ses->redirect("$c->{site_url}/?msg=Report sent successfully");

Thank you

[Namaless]

WOW!
Please change title to "[BUG] XSS Message Sent" for major identification about problem.

Regards.

[PilgrimX182]

Sorry guys, we have holidays over here, will fix everything on Monday.
But to quickly fix this "?msg=" you can add this to the end of "sub new" function in Session.pm:

Code: Select all

$self->f->{msg}=~s/[\<\>\"]+//g;

[Namaless]

Sorry guys, we have holidays over here, will fix everything on Monday.
But to quickly fix this "?msg=" you can add this to the end of "sub new" function in Session.pm:

Code: Select all

$self->f->{msg}=~s/[\<\>"]+//g;

I have tryed to edit this file, but I view crypted.. is possible to have a file fixed?

Regards.

[spyer]

i've tried adding the code Pilgrim wrote and it didn't work as it should.. i always get an error...
I encrypted the code so it become hopefully correct

Code: Select all

$frys+>s+>{zft}&=&~f/[\<\>\"]+//t;

but i've had some issues with it...

i added it in the [sub new] function as you said Pilgrim

so this is the final results

Code: Select all

$frys+>vavgPTV();
$frys+>{nhgu_pbbx}='ksff';
$frys+>s+>{zft}&=&~f/[\<\>\"]+//t;
erghea&$frys;

i've added it in line 20... now no message is sent when you try "?msg=whatever"

you get this number [4294967295] on all pages some green color some brown.

when you add this

Code: Select all

$frys+>s+>{zft}&=&//;

nothing come up.. also "?msg=" don't work at all


what do you think people?

[spyer]

i think i've got a solution,, i don't know if Pilgrim agree or not...

to replace

Code: Select all

LINE: 446 $ses->redirect("$c->{site_url}/?msg=Message sent successfully");
LINE: 1581 $ses->redirect("$c->{site_url}/?msg=Report sent successfully"); 

with

Code: Select all

LINE: 446 $f->{msg}.="Message sent successfully";
LINE: 1581 $f->{msg}.="Report sent successfully"; 

and mark the old line or remove it.. and if you ever need it you can find it here.... i've tested it and it works fine

[Namaless]

i think i've got a solution,, i don't know if Pilgrim agree or not...

to replace

Code: Select all

LINE: 446 $ses->redirect("$c->{site_url}/?msg=Message sent successfully");
LINE: 1581 $ses->redirect("$c->{site_url}/?msg=Report sent successfully"); 

with

Code: Select all

LINE: 446 $f->{msg}.="Message sent successfully";
LINE: 1581 $f->{msg}.="Report sent successfully"; 

and mark the old line or remove it.. and if you ever need it you can find it here.... i've tested it and it works fine

Is possible to get a file?

Regards.

[spyer]

what do you mean?

EDIT: the file is [index.cgi]

[Namaless]

what do you mean?

EDIT: the file is [index.cgi]

LOL!
All right, tomorrow search this lines into a files..

Regards.

[PilgrimX182]

Fixed msg vulnerability. Download latest ZIP from Client Area.
Also implemented Export files feature.
Also fixed e-mail sending.

[PilgrimX182]

2spyer: your solution is good, but I specially now use redirects instead to avoid dupe emails when user press F5 multiple times.

[spyer]

2spyer: your solution is good, but I specially now use redirects instead to avoid dupe emails when user press F5 multiple times.

Roger that

thx

[PilgrimX182]

Hehe, just made some extra XSS vulnerabilities research, found some good ones Try to add <h1> inside link for Link Checker
To avoid future XSS problems I'm now escaping "<>" symbols for all input variables.
It's inside Session.pm in latest ZIP.

P.S.: and don't play with Session.pm, it's under voodoo curse

[Namaless]

Thanks for export features..

Regards.

[spyer]

Hehe, just made some extra XSS vulnerabilities research, found some good ones Try to add <h1> inside link for Link Checker
To avoid future XSS problems I'm now escaping "<>" symbols for all input variables.
It's inside Session.pm in latest ZIP.

P.S.: and don't play with Session.pm, it's under voodoo curse

lolz


can you tell us the line number? coz it's all encrypted code