4images Cross Site Scripting / Clickjacking

[Aerosol]

# Affected software: 4images
# Type of vulnerability: clickjacking,xss
# URL: http://www.4homepages.de/
# Discovered by: Provensec
# Website: http://www.provensec.com
# Description: 4images is a powerful web-based image gallery management
system. Features include comment system, user registration and mangagement,
password protected administration area with browser-based upload and HTML
templates for page layout and design.
# Proof of concept

1st:click jacking --:

4images was vuln to clickjacking which could be exploited and used to
delete category

http://i.imgur.com/vqfz8Lk.png

clickjacking poc -:

http://prntscr.com/670r9b

2nd:  xss

adding a new category with xss payload leads to persistent xss vuln

http://prntscr.com/670rmi





-- 

Best Regards,
*Ankit Bharathan.*

*Save Energy... Save Nature... Go Green...*
P *Consider the environment. Please don't print this e-mail unless
absolutely necessary.*

Source