oss-sec mailing list archives

CVE Request - XXS in phpMyID (openid_error)

From: Adam Caudill <adam () adamcaudill com>
Date: Thu, 17 Apr 2014 01:25:03 -0400


There is a XXS vulnerability in phpMyID v0.9, in the openid_error parameter. The value passed into openid_error is 
passed through to the output without modification when openid.mode is “error”.

Example:

https://example.com/MyID.config.php?openid.mode=error&openid_error=%3Cscript%3Ealert(1)%3C/script%3E

Here is the code at fault:

MyID.php Line 569:
  function error_mode () {
        isset($_REQUEST['openid_error']) 
                ? wrap_html($_REQUEST['openid_error'])
                : error_500();
  }

MyID.php Line 1559:
  function wrap_html ( $message ) {
        global $charset, $profile;

        header('Content-Type: text/html; charset=' . $charset);
        echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" 
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
  <html>
  <head>
  <title>phpMyID</title>
  <link rel="openid.server" href="' . $profile['req_url'] . '" />
  <link rel="openid.delegate" href="' . $profile['idp_url'] . '" />
  ' . implode("\n", $profile['opt_headers']) . '
  <meta name="charset" content="' . $charset . '" />
  <meta name="robots" content="noindex,nofollow" />
  </head>
  <body>
  <p>' . $message . '</p>
  </body>
  </html>
  ';

        exit(0);
  }


Project Page: http://siege.org/phpmyid
Code: https://www.siege.org/oss/phpMyID/trunk/MyID.php

The author has stated that the project is no longer maintained, so hasn’t been notified, and thus there is no fixed 
version. This is being submitted to raise awareness among those that use this application, and in hopes that a new 
maintainer will take the project over and address the outstanding issues.

-- 
Adam Caudill
adam () adamcaudill com
http://adamcaudill.com/

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

Current thread:

CVE Request - XXS in phpMyID (openid_error) Adam Caudill (Apr 16)
- Re: CVE Request - XXS in phpMyID (openid_error) cve-assign (Apr 18)