Security Advisory - Curesec Research Team 1. Introduction Affected Product: 4images 1.7.12 Fixed in: 1.7.13 (update) Fixed Version Link: http://www.4homepages.de/download-4images Vendor Website: http://www.4homepages.de/ Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/29/2015 Disclosed to public: 12/02/2015 Release mode: Coordinated release CVE: Requested, but not assigned Credits Tim Coen of Curesec GmbH 2. Overview There are two reflected XSS vulnerabilities in 4images, as well as a persistent Open Redirect, which may also lead to XSS in older browsers. This allows an attacker to execute arbitrary JavaScript in the context of the browser of a victim if the victim clicks on an attacker supplied link or visits an attacker controlled website. With this, it is possible to bypass CSRF protection and thus do anything the victim can do, inject a JavaScript keylogger, or perform phishing attacks. It should be noted that the XSS vulnerability still existed in another form in the first release of version 1.17.13 and has been fixed with an update to that version. 3. Reflected XSS 1 CVSS Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Description When displaying the form to add new images, $_SERVER['PHP_SELF'] is echoed unencoded inside a select tag. Because of this, additional attributes can be added and new HTML tags can be created, leading to XSS. Proof of Concept Prior to Version 1.7.12: http://localhost/4images/admin/images.php/" onfocus=alert(1) autofocus foo="?action=addimages Version 1.7.13 (before update): http://localhost/4images/admin/images.php/');alert(1);window.location=('?action=addimages This required a click of the victim to trigger, and a redirect will be performed after the execution of the injected code. Code /admin/images.php show_num_select_row(" ", "num_newimages", $lang['num_addnewimages_desc']); /admin/admin_functions.php function show_num_select_row($title, $option, $desc = "") { global $site_sess, $PHP_SELF, $action, $$option; echo "\n

".$title."

\n"; echo "

".$desc; $url = $PHP_SELF; $url .= preg_match("/\?/", $url) ? "&" : "?"; $url .= "action=".$action; $url = $site_sess->url($url); echo "