#######################################################################
Fredrick Diggle Security Advisory
Application: The Internet
Versions: All Versions Affected
Platforms: All Platforms Affected
Bugs: XSS (Xtra Serious Software bugs)
Exploitation: Remote
Severity: Xtreme!!!!
Date: 15 Dec 2007
Credit: Fredrick Diggle
#######################################################################
1) Introduction
2) Bugs
4) Fix
#######################################################################
===============
1) Introduction
===============
Fredrick Diggle Security Services is probably the best application security
researchers on the scene this week. They have identified several hundred
thousand vulnerabilities this week for which Priv8 0dayz have been
developed. Fredrick Diggle Security Team has decided to release several of
these vulnerabilities to the community at large (Pre Vendor Release!!!!).
Fred Diggle would like to ensure that you understand this is 0DAY!!!. The
vendors are completely unaware of this vulnerabilities.
#######################################################################
=======
2) Bugs
=======
Dragonfly 9.6.0.1
echo isset($_GET['cat']) ? '&cat=' . $_GET['cat'] : '&cat=0' <--- XSS OMG!
Gael 0.4
echo $_GET["idel"]; <--- More XSS :/
Horde 3.1.3
echo isset($_GET['ext']) ? $_GET['ext'] : '' <--- This is an XSS
vulnerability
SQLiteManager 1.2.0
echo $_GET["lang"] <--- Hold me... I fear
ampache 3.3.2.1
echo "<img src=\"" . conf('web_path') . "/albumart.php?id=" . $_GET['id']
. "\" border=\"0\" />"; <--- The end is near :<
Amp 3.6.0
echo '<tr><td colspan="6"><b class="red">'. $_GET['msg']
.'</b></td></tr>'; <--- Danger Will Robinson
Twig 2.8.3
echo "<input type=\"hidden\" name=\"cc\" value=\"" . $_GET["cc"] .
"\">\n"; <--- Fredrick Diggle is out of ideas
Fredrick Diggle would like you to note that this is very small subset of the
0dayz that Fredrick Diggle Security Team has available. If you are rich and
would like to buy our Exploit codez Fredrick Diggle would very much like to
hear from you.
#######################################################################
======
4) Fix
======
There is no fix :> We are doomed :<
#######################################################################
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
