4images Forum & Community

4images Issues / Ausgaben => Discussion & Troubleshooting => Topic started by: mdwnn on April 05, 2008, 10:17:41 AM

Title: possible exploit: xss in 4images 1.7.4 and higher?
Post by: mdwnn on April 05, 2008, 10:17:41 AM

http://agoratalk.com/2008/01/23/4images-xss-site-hacking/ with a full video on how to exploit

http://www.calistaflockhart.hollywood.com/gallery/categories.php?cat_id=541 was defaced, running 1.7.4

I also see reports of attemps for 1.7.6?

http://forum.antichat.ru/threadedpost621227.html#post621227

Title: Re: possible exploit: xss in 4images 1.7.4 and higher?
Post by: matab on April 05, 2008, 02:38:13 PM

Hi there ...

This problem was solved long time ago

You have two ways : -

1 / to put this ( http://www. ) in homepage field  .

or

2 / to remove homepage code  from ur template

open (member_editprofile.html)
remove this code :

Code: [Select]

<td class="row1"><b>{lang_homepage}</b></td>
<td class="row1"><input type="text" name="user_homepage"  size="30" value="{user_homepage}" class="input" /></td>

Title: Re: possible exploit: xss in 4images 1.7.4 and higher?
Post by: mdwnn on April 05, 2008, 03:11:33 PM

So this is a confirmed xss exploit?  It would be good to have this in the release notes of the newer version if this was fixed?

Thanks for your reply.

Title: Re: possible exploit: xss in 4images 1.7.4 and higher?
Post by: Jan on April 07, 2008, 05:02:53 PM

To fix this, search in member.php for

Code: [Select]

$user_homepage = (isset($user_row['user_homepage'])) ? format_url($user_row['user_homepage']) : REPLACE_EMPTY;
and replace it with

Code: [Select]

$user_homepage = (isset($user_row['user_homepage'])) ? format_text(format_url($user_row['user_homepage']), 2) : REPLACE_EMPTY;

Title: Re: possible exploit: xss in 4images 1.7.4 and higher?
Post by: mawenzi on April 08, 2008, 12:12:41 PM

@ Jan

... are you sure about that ...
... after your change shows now for homepage ...

Quote

Homepage : http://www.my_website.de" target="_blank">http://www.my_website.de

... instead of ...

Quote

Homepage : http://www.my_website.de

Title: Re: possible exploit: xss in 4images 1.7.4 and higher?
Post by: Jan on April 08, 2008, 12:27:15 PM

You are right, the correct line is:

Code: [Select]

$user_homepage = (isset($user_row['user_homepage'])) ? format_text(format_url($user_row['user_homepage']), 2) : REPLACE_EMPTY;
I've update the fix in my previous post!

Title: Re: possible exploit: xss in 4images 1.7.4 and higher?
Post by: mawenzi on April 08, 2008, 12:50:54 PM

... now it shows the homepage in the correct way ...
... thanks Jan ...