Icy Phoenix 1.3.0.53a – HTTP Referer Persistent Cross-Site Scripting

• Exploit Database
• 31 阅读

• 作者： Saif El-Sherei
  日期： 2011-02-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/16199/

• # Exploit Title: Icy Phoenix 1.3.0.53a http referer stored XSS
  # Google Dork: " Powered by Icy Phoenix <http://www.icyphoenix.com/>"
  # Date: 16-2-2011
  # Author: Saif El-Sherei
  # Software Link: http://www.icyphoenix.com/dload.php?action=file&file_id=171
  # Version: Icy Phoenix 1.3.0.53a
  # Tested on:FF 3.0.15, IE 8
  # Vendor Response:
  http://www.icyphoenix.com/viewtopic.php?f=1&p=51700#p51700
  
  Info:
  
  Icy Phoenix is a CMS based on phpBB (a fully scalableand highly
  customisable open-source Bulletin Board
  package PHP based) plus many modifications and code integrations which add
  flexibility to the whole package. The official home page for phpBB is
  www.phpbb.com. Icy Phoenix has some features originally developed for phpBB
  XS Project which has been founded by Bicet and then developed by both Bicet
  and Mighty Gorgon. Icy Phoenix has been created by Mighty Gorgon after he
  left the phpBB XS Project.
  
  Details:
  
  there is a stoed XSS Vulnerability using http referer HTTP header due to
  failure in "index.php" in the acp to sanitize the http referer header any
  visitor to the site can comprmise the admin account or any user with
  privileges to see the "http referrers" section under the "Info" section. an
  attacker has to use an intrcepting proxy or manual server requests to add
  the " HTTP referer header" containing the POC to the server request.
  
  POC:
  
  <script>alert("XSS");</script>