diff options
| author | Sebastien SAUVAGE <sebsauvage@sebsauvage.net> | 2013-03-03 22:15:38 +0100 |
|---|---|---|
| committer | Sebastien SAUVAGE <sebsauvage@sebsauvage.net> | 2013-03-03 22:15:38 +0100 |
| commit | feebc6d466ba78c5a34b4f6bbdfcce6a0785e709 (patch) | |
| tree | b2f31bf1ebc328f8845b496d88f827d742262ac4 /.gitignore | |
| parent | 705f8355a95c899c154ba08a159c2d4840fd8c98 (diff) | |
| download | Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.tar.gz Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.tar.zst Shaarli-feebc6d466ba78c5a34b4f6bbdfcce6a0785e709.zip | |
Corrected vulnerabilities (see report below)
Title : Shaarli Vulnerabilities
Author : @erwan_lr | @_WPScan_
Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli
Download : https://github.com/sebsauvage/Shaarli/archive/master.zip |
http://sebsauvage.net/files/shaarli_0.0.40beta.zip
Affected versions : master-705F835, 0.0.40-beta (versions below may also
be vulnerable)
Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards
Persistent XSS :
- During the instalation or configuration modification, the title field
is vulnerable. e.g <script>alert(1)</script>
Quotes can not be used because of var_export(), but String.fromCharCode
works
- The url field of a link is vulnerable :
When there is no redirector : javascript:alert(1)
Then, the code is triggered when a user click the url of a link
Or with a classic XSS : "><script>alert(1)</script>
Unvalidated Redirects and Forwards :
A request with the param linksperpage or privateonly can be used to
redirect a user to an arbitrary referer
e.g
GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1
Host: 127.0.0.1
Referer: https://duckduckgo.com
History :
March 2, 2013
- Vendor contacted
Diffstat (limited to '.gitignore')
0 files changed, 0 insertions, 0 deletions