Quote:
SecWorm.net - Advisory
http://Secworm.net/
Cross Site Scripting [XSS] issue in Imageshack.us
--------------------------------------------------------------
1. Advisory Information:
--------------------------------------------------------------
Title:- Cross Site Scripting vulnerability in Imageshack.us
Advisory ID:- SecWormNetwork-2009-1
Advisory URL:-http://secworm.net/showthread.php?tid=23&action=lastpost
--------------------------------------------------------------
2. Vulnerability Information:
--------------------------------------------------------------
Class:- Cross Site Scripting
Remotely Exploitable:- Yes
Locally Exploitable:- Yes
--------------------------------------------------------------
3. Vulnerability Description:
--------------------------------------------------------------
When uploading multiple images, website redirects to an album information page which is vulnerable to cross site scripting. The URL can be modified to execute javascript within the security context of the imageshack.us domain. This can be used to hijack user's cookies and thus their authenticated sessions.
--------------------------------------------------------------
4. POC [Proof of Concept]:
--------------------------------------------------------------
http://img6.imageshack.us/gal.php?g=...9%3C/script%3E
Screenshot:- http://secworm.net/poc/secwormnetwork-2009-1.jpg
--------------------------------------------------------------
5. Credits:
--------------------------------------------------------------
This vulnerability was discovered by Nishant Soni (brainst0rm) from SecWorm Network.
--------------------------------------------------------------
6. Report Timeline:
--------------------------------------------------------------
15th December 2009 - Nishant Soni from SecWorm Network leaves an Email from "Contact Us" page at Imageshack.us
15th December 2009 - Nick from Imageshack.us replies to Nishant's email requesting vulnerability disclosure.
15th December 2009 - Nishant Soni reveals the vulnerability information to Nick.
Further Reply Awaited.
--------------------------------------------------------------
7. About SecWorm Network:
--------------------------------------------------------------
SecWorm Network is a group of Security Researchers & Ethical hackers with the motto of security awareness and helping others to secure themselves.
Everyone can reach to us at http://www.SecWorm.net/
--------------------------------------------------------------
8. Disclaimer & Copyright:
--------------------------------------------------------------
The contents of this advisory are copyright (c) 2009 SecWorm Network, and may be distributed freely provided that and proper credit is given.
