PhpSocial v2.0.0304: XSS

Date: 2015-12-21 10:59:38

1. Introduction

2. Overview

CVSS

Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description

PhpSocial is a social networking software written in PHP. In version v2.0.0304, the profile fields Name, Birthday, Street Address, City, State, Country, and Phone Number are open to persistent XSS.

This can lead to the stealing of cookies, injection of JavaScript keyloggers, and bypassing of CSRF protection. In this case, this can lead to code execution via the template editor.

3. Proof of Concept

Visit Profile: http://localhost/PhpSocial_v2.0.0304_20222226/cms_phpsocial/Profile.php?user=[USERNAME] Click edit and use the following for any of the vulnerable fields: <img src=no onerror=alert(1)>

4. Open Redirect

CVSS

Low 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N

Description

PhpSocial is also vulnerable to a reflected open redirect, which may for example be used in phishing attacks. The attack only works if the victim is logged in to PhpSocial.

Proof of Concept

http://localhost//PhpSocial_v2.0.0304_20222226/cms_phpsocial/UserEditprofileStatus.php?status_new=foobar&task=dosave&return_url=http://google.com

5. Solution

This issue was not fixed by the vendor.

6. Report Timeline