[HSC Security Group] Multiple XSS in phpopenchat 3.0.2

[zinho () hackerscenter com]

Hackers Center Security Group (http://www.hackerscenter.com/)            
Zinho's Security Advisory             

Desc: Multiple XSS in phpopenchat 3.0.2 
Risk: Medium to High  

"PHPOpenChat is a high performance php-based chat server software  for a live chat-room or -module on every php-based 
site." 


1. (permanent) XSS hole in profile.php and profile_misc.php 
"title" and "content" arguments passed with method POST are not  sanitized and can generate a permanent XSS hole thus 
stealing cookie  of anyone viewing the user profile page 

2. (permanent) XSS hole due to the previous in userpage.php. A  malicious user can manipulate the profile fields and 
the script will be  executed in userpage.php 

2. (permanent) XSS hole in mail.php 
Probably the most dangerous as it can be directed against a specified  user knowing just his nickname. 
"subject", "body" and the other email parameters are not sanitized. 

3. (temporary) XSS hole in invite.php 
"disinvited_chatter" and "invited_chatter" 

Vendor has been contacted some days ago but we got no reply so far. 


-- HSC Security Group 
Get your site audited for free and ay only if we find it vulnerable! 
http://www.hackerscenter.com/security 

Security researcher? Join us: mail me at zinho () hackerscenter com