Document Title:
===============
Webinars v2.2.26.0 - Client Side Cross Site Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1412
Release Date:
=============
2015-01-19
Vulnerability Laboratory ID (VL-ID):
====================================
1412
Common Vulnerability Scoring System:
====================================
2.4
Product & Service Introduction:
===============================
http://www.webinars.com
Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a client-side cross site scripting web vulnerability in the Webinars v2.2.26.0 conference web-application.
Vulnerability Disclosure Timeline:
==================================
2015-01-19: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
A client-side cross site scripting vulnerability has been discovered in the official InterCall Webinar v2.2.26.0 conference web-application.
The vulnerability allows remote attackers to hijack website customer, moderator or admin session data by client-side cross site requests.
The vulnerability is located in the `meeting_id` value of the `viewer.php` file. Remote attackers are able to inject malicious script codes to
client-side web-application requests. Remote attackers uses a validation error in the viewer.php file to execute client-side script code in the
webinar web-application context. The client-side script code execution occurs in the same file after a site refresh. The attack vector is located
on the client-side of the service and the request method to inject the script code is `GET`.
The security risk of the non-persistent input validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 2.4.
Exploitation of the client-side remote vulnerability requires low or medium user interaction and no privileged application user account. Successful exploitation
results in client-side account theft by hijacking, client-side phishing, client-side external redirects and client-side manipulation of affected and connected
module web context.
Vulnerable Service(s):
[+] Webinars
Vulnerable File(s):
[+] viewer.php
Vulnerable Parameter(s):
[+] meeting_id
Proof of Concept (PoC):
=======================
The client-side cross site scripting web vulnerability can be exploited by remote attackers without privileged applicaiton user account and low or medium user interaction.
For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.
--- PoC Session Logs [GET] ---
GET /viewer.php?meeting_id=%22%3E%27%3E%3CSCRIPT%3Ealert(document.cookie)%3C/SCRIPT%3E HTTP/1.1
Host: webinars.snm.org
-
User-Agent: Mozilla/5.0 (Windows NT 5.2; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
-
HTTP/1.1 200 OK
Date: Fri, 16 Jan 2015 18:10:12 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
Content-Length: 3044
Connection: close
Content-Type: text/html; charset=UTF-8
PoC: Webinar