Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by Daronet Internet Solutions

["LegendaryZion" <moskito () smile net il>]

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in "ViewImage.asp" by 
Daronet Internet Solutions
Discovered Date: 29/01/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.daronet.co.il

Details:

Daronet Internet Solutions website platform is prone to a Cross Site 
Scripting Vulnerability.
The vulnerability exists in "ViewImage.asp" file, caused by the lack of 
Input Validation/Filtering
of quotation and HTML characters in the GET parameter "Image".
The use of "ViewImage.asp" is done by "Funclib.js".

Contents of Funclib.js:
---------------------------------
...

function fnShowFullImg(sFile) {
 
window.open("ViewImage.asp?Image="+sFile,"image","top=50,left=50,width="+(screen.availWidth-100)+",height="+(screen.availHeight-100)+",scrollbars");}...After
 the function is being called, ViewImage.asp prints the following 
HTMLcode:------------------------------------------------------------------------------------------------------------------...<td
 style="border: 2px solid #FFFFFF;"><img src="<Unfiltered Input>"style="border: 1px solid 
#000000;"></td>...Exploitation URL:http://www.example.com/ViewImage.asp?Image=";>your xss code hereSuccessful 
exploitation may allow execution of script code. This could alsobe exploited to spoof the entire website's 
content,create fake login menu's for all the platform's users, commit Denial OfService attacks and more...Proof Of 
Concept:http://www.example.com/ViewImage.asp?Image=";><script>alert()<script>To view the full list of vulnerable 
websites:http://www.daronet.co.il/Index.asp?CategoryID=46&SubjectID=&Page=1Even http://www.2bsecure.co.i
 l!
....XSS + Phishing + Social =Daronet Internet Solutions provide an Administration System,that help customers to manage 
there website by log in to vulnerable XSSpage.The attacker has full access to the retrieved web page just as fake 
loginpage to the administration system,that cause customer may unintentionally login to attacker fake login page,and 
send the password of the administration system to the attacker.("hackthe 
website").http://support.daronet.com/usermanual4.0/ViewImage.asp?Image=";>Your XSS 
codeherehttp://support.daronet.com/basic3/ViewImage.asp?Image=";>Your XSS code hereThanks,Tal Argoni, 
CEHwww.zion-security.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/