|
|
|
|
| |
| XOOPS is a dynamic OO (Object Oriented) based open source portal script written in PHP. XOOPS is the ideal tool for developing small to large dynamic community websites, intra company portals, corporate portals, weblogs and much more. A vulnerability in the product allows remote attackers to cause the product to insert malicious HTML or JavaScript into existing pages. |
| |
Credit:
The information has been provided by vALDEUx.
|
| |
Vulnerable systems:
* XOOPS RC3 WebChat 1-5
Lines 291-299 from modules/WebChat/index.php :
if(isset($roomid)) {
if($xoopsUser) {
$wcusername = $xoopsUser->getVar("uname", "E");
$uid = $xoopsUser->getVar("uid", "E");
}
join_room($roomid,$pass,$wcusername,$uid); /* <- calling joinroom function with param $roomid */
} else {
disp_index($errmsg);
}
Lines 204-208 :
function join_room($roomid,$pass,$username,$uid) {
global $xoopsDB, $xoopsUser, $xoopsConfig, $ModName, $user, $sitename, $pnconfig, $language, $usertime;
unset($errmsg);
$sql = "SELECT rid, name, typ, pass, descript FROM ".$xoopsDB->prefix("chatroom")." WHERE rid = $roomid";
$row = mysql_fetch_array(mysql_query($sql));
[...]
Problem:
The value of $roomid id is included whitout verification.
Patch:
Add the following line in a the beginning of index.php or download PATCH from phpsecure.org:
$roomid = addslashes($roomid);
|
|
|
|
|
