# Exploit Title: Et-Chat 3.0.6 Cross Site Scripting Vulnerability # Google Dork: "ET-Chat v3.0.6" # Date: 2015-03-20 # Exploit Author: IranHack Security Team # Tested on: Windows 7 # Vendor : Www.Et-chat.Ir # Our Website : Www.IranHack.Org *************************************************** Vulnerable code : Location : /etchat/class/admin/AdminRoomsIndex.class.php Code : if (is_array($feld)){ $print_room_list = ""; foreach($feld as $datasets){ if ($datasets[0]!=1) $print_room_list.= ""; else $print_room_list.= ""; } $print_room_list.= "
".$datasets[1]."   _prefix.'CheckSum4RegUserEdit']."\">".$lang->delete[0]->tagData."".$lang->rename[0]->tagData."   ".$lang->room_priv[$datasets[2]]->tagData."
".$datasets[1]."   ".$lang->delete[0]->tagData."".$lang->rename[0]->tagData."   ".$lang->room_priv[$datasets[2]]->tagData."
"; } *************************************************** Description : This vulnerability allows attacker to grab admin cookie and login with admin account :) The reason of this vulnerability is that values of the room list ( ".$datasets[1]." ) is not filtered and allows attacker to run javascript code. *************************************************** Exploit : 1- Upload this page in a host or Set this code in a html page :
2- Give the uploaded html page address to admin. 3- after opening this page by admin , cookies are logged in Log.txt :) *************************************************** grabber.php : http://up.iranhack.org/uploads/lquswjwo06vrxz1fe4oo.zip *************************************************** Patch : If u wanna patch this bug , go to file " /etchat/class/admin/AdminRoomsIndex.class.php " Replace this codes : ".$datasets[1]." With this code : ".htmlspecialchars($datasets[1])." *************************************************** Greetz : Mr.XpR , V30Sharp , AL1R3Z4 , Secret.Walker , Irblackhat , FarbodEZRaeL , black-sec , Mr.X2 , @3is , IR4N0nY , , 0x8F , Amirio , 3cure , FTA_Boy , Mr.FixXxer ./Moji.Rider