[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <67991BCF-9449-4116-B6C9-585B483CC9E0@adamcaudill.com>
Date: Thu, 17 Apr 2014 01:25:03 -0400
From: Adam Caudill <adam@...mcaudill.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE Request - XXS in phpMyID (openid_error)
There is a XXS vulnerability in phpMyID v0.9, in the openid_error parameter. The value passed into openid_error is passed through to the output without modification when openid.mode is “error”.
Example:
https://example.com/MyID.config.php?openid.mode=error&openid_error=%3Cscript%3Ealert(1)%3C/script%3E
Here is the code at fault:
MyID.php Line 569:
function error_mode () {
isset($_REQUEST['openid_error'])
? wrap_html($_REQUEST['openid_error'])
: error_500();
}
MyID.php Line 1559:
function wrap_html ( $message ) {
global $charset, $profile;
header('Content-Type: text/html; charset=' . $charset);
echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<title>phpMyID</title>
<link rel="openid.server" href="' . $profile['req_url'] . '" />
<link rel="openid.delegate" href="' . $profile['idp_url'] . '" />
' . implode("\n", $profile['opt_headers']) . '
<meta name="charset" content="' . $charset . '" />
<meta name="robots" content="noindex,nofollow" />
</head>
<body>
<p>' . $message . '</p>
</body>
</html>
';
exit(0);
}
Project Page: http://siege.org/phpmyid
Code: https://www.siege.org/oss/phpMyID/trunk/MyID.php
The author has stated that the project is no longer maintained, so hasn’t been notified, and thus there is no fixed version. This is being submitted to raise awareness among those that use this application, and in hopes that a new maintainer will take the project over and address the outstanding issues.
--
Adam Caudill
adam@...mcaudill.com
http://adamcaudill.com/
Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
