Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: hack3686.htm

e107 web portal Referers HTTP Injection



e107 web portal Referers HTTP Injection



Synopsis:



All versions of e107 have a vulnerability that

allows html tags and content to be posted to the stats

page and to be listed under Referers and may also list

a screen size that they wish.





Description:



All versions of e107 have a vulnerability that

allows html tags and content to be posted to the stats

page and to be listed under Referers and thus allowing

an attacker to put any site link or code they want on

the list of Referers.



The Problem lies within the e107 log plugin

file /e107_plugins/log/log.php as it does not parse

< > and / tags thus allowing a user to enter html

content like so:



target.com/e107_plugins/log/log.php?referer=

code
goes &color=24&eself=http://www.target.com/stats.php&res=1341X1341 This would print out: code goes here In the Referers list and print out a screen size of 1341x1341 with a color depth of 24. Impact: This could lead someone to graffiti the stats page with content of their liking which could further lead someone to input their account info, etc. With use of proxies someone may also advertise their site as the top referer. Work-around: The easiest way to fix this problem is to simply turn off stats all together. Even if you edit log.php to parse html tags people will still be able to post text to the Referers list.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH