|
GuppY Cross Site Scripting and Exposure of Admin Password
|
|
Secunia Advisory:
|
SA9946
|
|
|
Release Date:
|
2003-10-06
|
|
Popularity:
|
7,184 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Cross Site Scripting
Manipulation of data
Exposure of sensitive information
Privilege escalation
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | GuppY 2.x (aldweb miniPortail)
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Multiple vulnerabilities have been identified in GuppY allowing malicious people to conduct Cross Site Scripting and retrieve the admin password.
1) It is possible to bypass the input filter by using "[]" instead of "<>". This allows malicious people to include arbitrary HTML or scripting in the "ptxt" parameter.
2) Certain users preferences are stored in the "GuppYUser" cookie seperated by "||", including a formatting parameter (the seventh parameter), which is included in messages and postings. This allows malicious people to include arbitrary HTML or script.
3) It is possible to manipulate polls because of lack of input validation of the "to" parameter in "tinymsg.php". This could potentially be used to add arbitrary data to all writeable files.
Example:
/tinymsg.php?action=2&from=Youpi!||Great !||rose||10000&msg=1&to=../poll
4) An example exploiting the "GuppYUser" cookie and the script "tinymsg.php" to retrieve the "admin/mdp.php" file with the MD5 hashed "admin" password has also been provided.
This has been reported to affect 2.4p3 and prior.
Solution:
This has been fixed in version 2.4p4, patches are also available:
http://www.freeguppy.org/download.php?lng=en
Provided and/or discovered by:
frog-m@n
Original Advisory:
http://www.phpsecure.info/v2/tutos/GuppY.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
