OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: StatiX Statix (mail_statix_at_linuxmail.org)
Date: Fri Jan 24 2003 - 16:30:10 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    List Site Pro v2 user account Hijacking vulnerablity
    Severity:Low
    homepage:http://www.listsitepro.com

    It is possible to take over another user account by signing up and using | in one of the required feilds.
    List Site Pro uses '|' to delimit the database but the form input is not checked and stripped of them.
    So a user could sign up like this
    username:username
    email:emailemial.com
    url:www.url.com
    bannerurl:www.site.com/banner.gif ||password|1036360992|60|468
    banner height:68
    banner width:460
    password:pass

    this would take over the account 1036360992 and let the user log in with the password 'password'
    Since the user id is displayed in teh link of the topsite, an attacker could successfully log into whatever
    account he chooses to. Then the attacker could change the link the banner points to, or any thing else in the account.
    This doesn't give the attacker admin access. But it gives him an opportunity to render the topsite useless.

    I contacted the author(s) (http://www.listsitepro.com/) on 11-3-02 and again 12-01-02. no response from either request.

    StatiX
    mail_statixlinuxmail.org 

    -- 
______________________________________________
http://www.linuxmail.org/
Now with e-mail forwarding for only US$5.95/yr

    Powered by Outblaze