oss-sec mailing list archives
CVE Request - XXS in phpMyID (openid_error)
From: Adam Caudill <adam () adamcaudill com>
Date: Thu, 17 Apr 2014 01:25:03 -0400
There is a XXS vulnerability in phpMyID v0.9, in the openid_error parameter. The value passed into openid_error is passed through to the output without modification when openid.mode is “error”. Example: https://example.com/MyID.config.php?openid.mode=error&openid_error=%3Cscript%3Ealert(1)%3C/script%3E Here is the code at fault: MyID.php Line 569: function error_mode () { isset($_REQUEST['openid_error']) ? wrap_html($_REQUEST['openid_error']) : error_500(); } MyID.php Line 1559: function wrap_html ( $message ) { global $charset, $profile; header('Content-Type: text/html; charset=' . $charset); echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html> <head> <title>phpMyID</title> <link rel="openid.server" href="' . $profile['req_url'] . '" /> <link rel="openid.delegate" href="' . $profile['idp_url'] . '" /> ' . implode("\n", $profile['opt_headers']) . ' <meta name="charset" content="' . $charset . '" /> <meta name="robots" content="noindex,nofollow" /> </head> <body> <p>' . $message . '</p> </body> </html> '; exit(0); } Project Page: http://siege.org/phpmyid Code: https://www.siege.org/oss/phpMyID/trunk/MyID.php The author has stated that the project is no longer maintained, so hasn’t been notified, and thus there is no fixed version. This is being submitted to raise awareness among those that use this application, and in hopes that a new maintainer will take the project over and address the outstanding issues. -- Adam Caudill adam () adamcaudill com http://adamcaudill.com/
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
Current thread:
- CVE Request - XXS in phpMyID (openid_error) Adam Caudill (Apr 16)
- Re: CVE Request - XXS in phpMyID (openid_error) cve-assign (Apr 18)