CXSecurity WLB-2015040034 6kbbs v8.0 Multiple CSRF (Cross-Site Request Forgery) Web Security Vulnerabilities

Posted by WhiteHole

CXSecurity WLB-2015040034 6kbbs v8.0 Multiple CSRF (Cross-Site Request Forgery) Web Security Vulnerabilities

Exploit Title: 6kbbs Multiple CSRF (Cross-Site Request Forgery) Security Vulnerabilities

Vendor: 6kbbs

Product: 6kbbs

Vulnerable Versions: v7.1 v8.0

Tested Version: v7.1 v8.0

Advisory Publication: April 02, 2015

Latest Update: April 02, 2015

Vulnerability Type: Cross-Site Request Forgery (CSRF) [CWE-352]

CVE Reference: *

CXSecurity Reference: WLB-2015040034

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 6.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

Writer and Reporter: Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

Suggestion Details:

(1) Vendor & Product Description:

Vendor:

6kbbs

Product & Vulnerable Versions:

6kbbs

v7.1

v8.0

Vendor URL & download:

6kbbs can be gain from here,

http://www.6kbbs.com/download.html

http://en.sourceforge.jp/projects/sfnet_buzhang/downloads/6kbbs.zip/

Product Introduction Overview:

“6kbbs V8.0 is a PHP + MySQL built using high-performance forum, has the code simple, easy to use, powerful, fast and so on. It is an excellent community forum program. The program is simple but not simple; fast, small; Interface generous and good scalability; functional and practical pursuing superior performance, good interface, the user’s preferred utility functions.”

“1, using XHTML + CSS architecture, so that the structure of the page, saving transmission static page code, but also easy to modify the interface, more in line with WEB standards; 2, the Forum adopted Cookies, Session, Application and other technical data cache on the forum, reducing access to the database to improve the performance of the Forum. Can carry more users simultaneously access; 3, the data points table function, reduce the burden on the amount of data when accessing the database; 4, support for multi-skin style switching function; 5, the use of RSS technology to support subscriptions forum posts, recent posts, user’s posts; 6, the display frame mode + tablet mode, the user can choose according to their own preferences to; 7. forum page optimization keyword search, so the forum more easily indexed by search engines; 8, extension, for our friends to provide a forum for a broad expansion of space services; 9, webmasters can add different top and bottom of the ad, depending on the layout; 10, post using HTML + UBB way the two editors, mutual conversion, compatible with each other; …”

(2) Vulnerability Details:

6kbbs web application has a computer cyber security bug problem. It can be exploited by CSRF (Cross-Site Request Forgery) attacks. This may allow an attacker to trick the victim into clicking on the image to take advantage of the trust relationship between the authenticated victim and the application. Such an attack could trick the victim into creating files that may then be called via a separate CSRF attack or possibly other means, and executed in the context of their session with the application, without further prompting or verification.

Several 6kbbs products 0-day vulnerabilities have been found by some other bug hunter researchers before. 6kbbs has patched some of them. Open Sourced Vulnerability Database (OSVDB) is an independent and open-sourced database. The goal of the project is to provide accurate, detailed, current, and unbiased technical information on security vulnerabilities. The project promotes greater, open collaboration between companies and individuals. It has published suggestions, advisories, solutions details related to csrf vulnerabilities.

(2.1) The first code programming flaw occurs at “/portalchannel_ajax.php?” page with “&id” and &code” parameters in HTTP $POST.

(2.2) The second code programming flaw occurs at “/admin.php?” page with “&fileids” parameter in HTTP $POST.

CVE-2014-9469 vBulletin XSS (Cross-Site Scripting) Web Security Vulnerabilities

Posted by WhiteHole

CVE-2014-9469 vBulletin XSS (Cross-Site Scripting) Web Security Vulnerabilities

Exploit Title: vBulletin XSS (Cross-Site Scripting) Web Security Vulnerabilities

Product: vBulletin Forum

Vendor: vBulletin

Vulnerable Versions: 5.1.3 5.0.5 4.2.2 3.8.7 3.6.7 3.6.0 3.5.4

Tested Version: 5.1.3 4.2.2

Advisory Publication: February 12, 2015

Latest Update: February 26, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9469

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Writer and Creditor: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Preposition Details:

(1) Vendor & Product Description:

Vendor:

vBulletin

Product & Version:

vBulletin Forum

5.1.3 5.0.5 4.2.2 3.8.7 3.6.7 3.6.0 3.5.4

Vendor URL & Download:

vBulletin can be acquired from here,

https://www.vbulletin.com/purchases/

Product Introduction Overview:

“vBulletin (vB) is a proprietary Internet forum software package developed by vBulletin Solutions, Inc., a division of Internet Brands. It is written in PHP and uses a MySQL database server.”

Since the initial release of the vBulletin forum product in 2000, there have been many changes and improvements. Below is a list of the major revisions and some of the changes they introduced. The current production version is 3.8.7, 4.2.2, and 5.1.3.

Simplified site set up and customization

The new Site Builder makes it easier than ever to build and manage a site. Customizable page templates, drag-and-drop configuration and in-line site editing simplify page layout. A variety of design themes can be easily selected.
Dynamic tools for content discovery

Customizable content modules provide enhanced content discovery, engaging users into deeper site visits. The vBulletin search has been re-architected to significantly improve the quality of its results, further facilitating content discovery.
Sleek new UI features activity stream and increased social engagement

Improved social functionality includes groups, new user profiles, comments functionality, an integrated messaging hub, social content curation, real-time updates and more.
Expanded photo and video capabilities

The new interface invites users to quickly post photos and video, expanding content on vBulletin sites. This media is then leveraged by being better integrated with the rest of a site’s content. User profiles provide an engaging aggregation of all media posted by them.
Category-leading mobile optimization

The integrated mobile-optimized version ensures smartphone visitors will stay longer and return.
Robust architecture

Improved architecture provides better performance and easier customization

Built-in SEO helps maximize search traffic

Easy-to-use upgrader tool available for vBulletin 3 and 4 sites, plus importer for sites on other forum software”

(2) Vulnerability Details:

vBulletin web application has a computer security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. vBulletion has patched some of them. Gmane (pronounced “mane”) is an e-mail to news gateway. It allows users to access electronic mailing lists as if they were Usenet newsgroups, and also through a variety of web interfaces. Gmane is an archive; it never expires messages (unless explicitly requested by users). Gmane also supports importing list postings made prior to a list’s inclusion on the service. It has published suggestions, advisories, solutions related to important vulnerabilities.

(2.1) The programming code flaw occurs at “forum/help” page. Add “hash symbol” first. Then add script at the end of it.

References:

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9469

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9469

http://packetstormsecurity.com/files/authors/11270

https://progressive-comp.com/?a=139222176300014&r=1&w=1%E2%80%8B

http://lists.openwall.net/full-disclosure/2015/02/13/3

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01684.html

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1588

http://seclists.org/fulldisclosure/2015/Feb/49

https://www.facebook.com/permalink.php?story_fbid=880689078636904&id=825031907535955&__mref=message_bubble

http://shellmantis.tumblr.com/post/118777939056/lifegrey-cve-2014-9469-vbulletin-xss#notes

http://testingcode.lofter.com/post/1cd26eb9_6eec951

https://www.facebook.com/permalink.php?story_fbid=661392814005834&id=594347777377005&__mref=message_bubble

http://tetraph.blogspot.com/2015/05/cve-2014-9469-vbulletin-xss-cross-site.html

https://vulnerabilitypost.wordpress.com/2015/05/12/cve-2014-9469-vbulletin-xss/

https://www.facebook.com/computersecurities/posts/375780759275383?
http://tetraph.lofter.com/post/1cc758e0_6eeac27

https://plus.google.com/102963385033389079817/posts/1ACxSMZYmCS

http://computerobsess.blogspot.com/2015/05/cve-2014-9469-vbulletin-xss-cross-site.html

https://twitter.com/justqdjing/status/598116948245807105

CVE-2015-1475 – My Little Forum Multiple XSS Web Security Vulnerabilities

Posted by WhiteHole

CVE-2015-1475 – My Little Forum Multiple XSS Web Security Vulnerabilities

Exploit Title: My Little Forum Multiple XSS Web Security Vulnerabilities

Vendor: My Little Forum

Product: My Little Forum

Vulnerable Versions: 2.3.3 2.2 1.7

Tested Version: 2.3.3 2.2 1.7

Advisory Publication: February 04, 2015

Latest Update: February 11, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2015-1475

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Credit: Jing Wang [School of Mathematical Sciences (001), University of Science and Technology of China (USTC)] (@justqdjing)

Recommendation Details:

(1) Vendor & Product Description

Vendor:

My Little Forum

Product & Version:

My Little Forum

2.3.3

2.2

1.7

Vendor URL & Download:

http://mylittleforum.net/

Product Description:

“my little forum is a simple PHP and MySQL based internet forum that displays the messages in classical threaded view (tree structure). It is Open Source licensed under the GNU General Public License. The main claim of this web forum is simplicity. Furthermore it should be easy to install and run on a standard server configuration with PHP and MySQL.

Features

Usenet like threaded tree structure of the messages

Different views of the threads possible (classical, table, folded)

Categories and tags

BB codes and smilies

Image upload

Avatars

RSS Feeds

Template engine (Smarty)

Different methods of spam protection (can be combined: graphical/mathematical CAPTCHA, wordfilter, IP filter, Akismet, Bad-Behavior)

Localization: language files, time zone and UTF-8 support (see current version for already available languages)”

(2) Vulnerability Details:

My Little Forum web application has a computer security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server.

Several similar products vulnerabilities have been found by some other bug hunter researchers before. My Little Forum has patched some of them. The MITRE Corporation is a not-for-profit company that operates multiple federally funded research and development centers (FFRDCs), which provide innovative, practical solutions for some of our nation’s most critical challenges in defense and intelligence, aviation, civil systems, homeland security, the judiciary, healthcare, and cybersecurity. It has published suggestions, advisories, solutions details related to XSS vulnerabilities.

(2.1) The first programming code flaw occurs at “forum.php?” page with “&page”, “&category” parameters.

(2.2) The second programming code flaw occurs at “board_entry.php?” page with “&page”, “&order” parameters.

(2.3) The third programming code flaw occurs at “forum_entry.php” page with “&order”, “&page” parameters.

References:

http://tetraph.com/security/xss-vulnerability/my-little-forum-multiple-xss-security-vulnerabilities/

http://securityrelated.blogspot.com/2015/02/my-little-forum-multiple-xss-security.html

http://seclists.org/fulldisclosure/2015/Feb/15

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01652.html

http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1553

http://packetstormsecurity.com/files/authors/11270

http://marc.info/?a=139222176300014&r=1&w=4

http://lists.openwall.net/full-disclosure/2015/02/03/2

http://essaybeans.blogspot.com/2015/05/cve-2015-1475-my-little-forum-multiple.html

http://www.osvdb.org/creditees/12822-wang-jing

https://infoswift.wordpress.com/2015/05/12/cve-2015-1475-my-little-forum-multiple-xss-web-security-vulnerabilities/

https://twitter.com/tetraphibious/status/597971919892185088

http://japanbroad.blogspot.jp/2015/05/cve-2015-1475-my-little-forum-multiple.html

https://www.facebook.com/tetraph/posts/1649600031926623

http://user.qzone.qq.com/2519094351/blog/1431403836

https://www.facebook.com/permalink.php?story_fbid=460795864075109&id=405943696226993

https://plus.google.com/+wangfeiblackcookie/posts/Sj63XDPhH1j

http://essayjeans.blog.163.com/blog/static/2371730742015412037547/#

http://whitehatpost.lofter.com/post/1cc773c8_6ed5839

http://whitehatview.tumblr.com/post/118754859716/cve-2015-1475-my-little-forum-multiple-xss-web

CVE-2014-9468 InstantASP InstantForum.NET Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Posted by WhiteHole

CVE-2014-9468 InstantASP InstantForum.NET Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Exploit Title: InstantASP InstantForum.NET Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: InstantForum.NET

Vendor: InstantASP

Vulnerable Versions: v4.1.3 v4.1.1 v4.1.2 v4.0.0 v4.1.0 v3.4.0

Tested Version: v4.1.3 v4.1.1 v4.1.2

Advisory Publication: Feb 18, 2015

Latest Update: Feb 18, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-9468

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Credit: Wang Jing [Mathematics, Nanyang Technological University, Singapore]

Advisory Details:

(1) Vendor & Product Description:

Vendor:

InstantASP

Product & Version:

InstantForum.NET

v4.1.3 v4.1.1 v4.1.2 v4.0.0 v4.1.0 v3.4.0

Vendor URL & Download:

InstantForum.NET can be downloaded from here,

http://docs.instantasp.co.uk/InstantForum/default.html?page=v413tov414guide.html

Product Introduction:

“InstantForum.NET is a feature rich, ultra high performance ASP.NET & SQL Server discussion forum solution designed to meet the needs of the most demanding online communities or internal collaboration environments. Now in the forth generation, InstantForum.NET has been completely rewritten from the ground-up over several months to introduce some truly unique features & performance enhancements.”

“The new administrator control panel now offers the most comprehensive control panel available for any ASP.NET based forum today. Advanced security features such as role based permissions and our unique Permission Sets feature provides unparalleled configurable control over the content and features that are available to your users within the forum. Moderators can easily be assigned to specific forums with dedicated moderator privileges for each forum. Bulk moderation options ensure even the busiest forums can be managed effectively by your moderators.”

“The forums template driven skinning architecture offers complete customization support. Each skin can be customized to support a completely unique layout or visual appearance. A single central style sheet controls every aspect of a skins appearance. The use of unique HTML wrappers and ASP.NET 1.1 master pages ensures page designers can easily integrate an existing design around the forum. Skins, wrappers & master page templates can be applied globally to all forums or to any specific forum.”

(2) Vulnerability Details:

InstantForum.NET has a security problem. It can be exploited by XSS attacks.

(2.1) The first vulnerability occurs at “Join.aspx” page with “SessionID” parameter of it.

(2.2) The second vulnerability occurs at “Logon.aspx” page with “SessionID” parameter of it.

References:

http://tetraph.com/security/cves/cve-2014-9468-instantasp-instantforum-net-multiple-xss-cross-site-scripting-security-vulnerabilities/

http://securityrelated.blogspot.com/2015/02/cve-2014-9468-instantasp.html

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9468

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9468

https://security-tracker.debian.org/tracker/CVE-2014-9468

http://www.cvedetails.com/cve/CVE-2014-9468/

http://www.security-database.com/detail.php?alert=CVE-2014-9468

http://packetstormsecurity.com/files/cve/CVE-2014-9468

http://www.pentest.it/cve-2014-9468.html

http://www.naked-security.com/cve/CVE-2014-9468/

http://www.inzeed.com/kaleidoscope/cves/cve-2014-9468/

http://007software.net/cve-2014-9468/

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/cve-2014-9468/

https://vulnerabilitypost.wordpress.com/2015/02/18/cve-2014-9468/

https://security-tracker.debian.org/tracker/CVE-2014-9468

About Group (about.com) All Topics (At least 99.88% links) Vulnerable to XSS & Iframe Injection Security Attacks, About.com Open Redirect Web Security Vulnerabilities

Posted by WhiteHole

About Group (about.com) All Topics (At least 99.88% links) Vulnerable to XSS & Iframe Injection Security Attacks, About.com Open Redirect Security Vulnerabilities

Vulnerability Description:
About.com all “topic sites” are vulnerable to XSS (Cross-Site Scripting) and Iframe Injection (Cross Frame Scripting) attacks. This means all sub-domains of about.com are affected. Based on a self-written program, 94357 links were tested. Only 118 links do not belong to the topics (Metasites) links. Meanwhile, some about.com main pages are vulnerable to XSS attack, too. This means no more than 0.125% links are not affected. At least 99.875% links of About Group are vulnerable to XSS and Iframe Injection attacks. In fact, for about.com’s structure, the main domain is something just like a cover. So, very few links belong to them.

Simultaneously, the About.com main page’s search field is vulnerable to XSS attacks, too. This means all domains related to about.com are vulnerable to XSS attacks.

For the Iframe Injection vulnerability. They can be used to do DDOS (Distributed Denial-of-Service Attack) to other websites, too.

Here is one example of DDOS based on Iframe Injection attacks of others.
http://www.incapsula.com/blog/world-largest-site-xss-ddos-zombies.html

In the last, some “Open Redirect” vulnerabilities related to about.com are introduced. There may be large number of other Open Redirect Vulnerabilities not detected. Since About.com are trusted by some the other websites. Those vulnerabilities can be used to do “Covert Redirect” to these websites.

Vulnerability Disclosure:
Those vulnerabilities were reported to About on Sunday, Oct 19, 2014. No one replied. Until now, they are still unpatched.

Vulnerability Discover:
Jing Wang, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@Justqdjing)
http://www.tetraph.com/wangjing

(1) Some Basic Background

(1.1) Domain Description:
http://www.about.com/
http://www.alexa.com/siteinfo/about.com

“For March 2014, 61,428,000 unique visitors were registered by comScore for About.com, making it the 16th-most-visited online property for that month.” (The New York Times)

“About.com, also known as The About Group (formerly About Inc.), is an Internet-based network of content that publishes articles and videos about various subjects on its “topic sites,” of which there are nearly 1,000. The website competes with other online resource sites and encyclopedias, including those of the Wikimedia Foundation, and, for March 2014, 61,428,000 unique visitors were registered by comScore for About.com, making it the 16th-most-visited online property for that month. As of August 2012, About.com is the property of IAC, owner of Ask.com and numerous other online brands, and its revenue is generated by advertising.” (Wikipedia)

“As of May 2013, About.com was receiving about 84 million unique monthly visitors.” (TechCrunch. AOL Inc.)

“According to About’s online media kit, nearly 1,000 “Experts” (freelance writers) contribute to the site by writing on various topics, including healthcare and travel.” (About.com)

(1.2) Topics Related to About.com
“The Revolutionary About.com Directory and Community Metasite. Hundreds of real live passionate Guides covering Arts, Entertainment, Business, Industry, Science, Technology, Culture, Health, Fitness, Games,Travel, News, Careers, Jobs, Sports, Recreation, Parenting, Kids, Teens, Moms, Education, Computers, Hobbies and Local Information.” (azlist.about.com)

About.com – Sites A to Z

Number of Topics

A: 66

B: 61

C: 118

D: 49

E: 33

F: 57

G: 39

H: 48

I: 32

J: 15

K: 13

L: 36

M: 70

N: 26

O: 23

P: 91

Q: 4

R: 32

S: 104

T: 47

U: 12

V: 9

W: 43

X: 1

Y: 4

Z: 1

SUM: 1039

Reference: azlist.about.com/

In fact, those are not all topics of about.com. Some of the topics are not listed here such as,
http://specialchildren.about.com

So, there are more than 1000 topics related to about.com.

(1.3) Result of Exploiting XSS Attacks
XSS may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user’s browser session within the trust relationship between their browser and the server.

Base on Acunetix, exploited XSS is commonly used to achieve the following malicious results:

“Identity theft

Accessing sensitive or restricted information

Gaining free access to otherwise paid for content

Spying on user’s web browsing habits

Altering browser functionality

Public defamation of an individual or corporation

Web application defacement

Denial of Service attacks (DOS)

” (Acunetix)

(1.4) Basics of Iframe Injection (Cross-frame-Scripting) Vulnerabilities
“In an XFS (Cross-frame-Scripting) attack, the attacker exploits a specific cross-frame-scripting bug in a web browser to access private data on a third-party website. The attacker induces the browser user to navigate to a web page the attacker controls; the attacker’s page loads a third-party page in an HTML frame; and then JavaScript executing in the attacker’s page steals data from the third-party page.” (OWASP)

“XFS also sometimes is used to describe an XSS attack which uses an HTML frame in the attack. For example, an attacker might exploit a Cross Site Scripting Flaw to inject a frame into a third-party web page; or an attacker might create a page which uses a frame to load a third-party page with an XSS flaw.” (OWASP)

(1.5) Basic of Open Redirect (Dest Redirect Privilege Escalation) Vulnerabilities
“An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.” (OWASP)

Open redirect is listed in OWASP top 10. The general consensus of it is “avoiding such flaws is extremely important, as they are a favorite target of phishers trying to gain the user’s trust.”

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. CNN has patched some of them. “The Full Disclosure mailing list is a public forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. FD differs from other security lists in its open nature and support for researchers’ right to decide how to disclose their own discovered bugs. The full disclosure movement has been credited with forcing vendors to better secure their products and to publicly acknowledge and fix flaws rather than hide them. Vendor legal intimidation and censorship attempts are not tolerated here!” A great many of the following web securities have been published here, Injection, Broken Authentication and Session Management, Cross-Site Scripting (XSS), Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Function Level Access Control, Cross-Site Request Forgery (CSRF), Using Components with Known Vulnerabilities, Unvalidated Redirects and Forwards. It also publishes suggestions, advisories, solutions details related to XSS and URL Redirection vulnerabilities and cyber intelligence recommendations.

(2) About Group About.com All Topics (At least 99.88% links) Vulnerable to XSS (Cross-Site Scripting) Security Attacks

Domain:
http://www.about.com/

Vulnerability description:

A method was found to attack users of About.com based XSS attacks.

All links under the topics of about.com can be used for this attack.

Just attach “/lr/” to any About.com’s sub-domains. Then attach “any codes + sciript” or attach “script” code directly is OK. The structure is “http://subdomain.about.com/lr/*/script_code/*“.

The vulnerability can be attacked without user login. Tests were performed on Mozilla Firefox (26.0) in Ubuntu (14.04) and Microsoft IE (9.0.15) in Windows 7.

POC Codes, e.g.

/”><svg/onload=alert(/justqdjing/)>

http://ipod.about.com/lr/ipad_how-tos/9033“><svg/onload=alert(/justqdjing/)>

http://bizfinance.about.com/lr/businesscredit/fl/5-Ways-to-Start-Establishing-Business-Identity-Theft-Protection.htm/“><svg/onload=alert(/justqdjing/)>

http://recycling.about.com/lr/Collecting/ss/EPS-Recycling-5-Reasons-Why-and-2-Why-Not.htm/“><svg/onload=alert(/justqdjing/)>

http://dc.about.com/lr/shopping/a/BlkFriday.htm/“><svg/onload=alert(/justqdjing/)>

http://healthtech.about.com/lr/Patient-Portals/fl/5-Ways-a-Patient-Portal-Can-Improve-Your-Health-Care-Experience.htm/“><svg/onload=alert(/justqdjing/)>

POC Video:
https://www.youtube.com/watch?v=h5yELiJBxWo&feature=youtu.be

Blog Detail:
http://securityrelated.blogspot.com/2015/02/about-group-aboutcom-all-topics-at_2.html
http://tetraph.com/security/xss-vulnerability/about-group-about-com-all-topics-at-least-99-88-links-vulnerable-to-xss-cross-site-scripting-security-attacks/

(3) About Group About.com Main Page’s Search Field XSS (Cross-Site Scripting) Security Vulnerabilities

Vulnerability description:
The web application About.com online website has a security bug problem. It can be exploited by XSS attacks.

The code programming flaw occurs at about.com main page’s search field, e.g.
http://www.about.com/?q=googleandroidsystem

POC Codes, e.g.

“–/>”><img src=x onerror=prompt(/justqdjing/)>

http://www.about.com/?q=“–/>”><img src=x onerror=prompt(/justqdjing/)>

POC Video:
https://www.youtube.com/watch?v=H4G7b_Jkqvw&feature=youtu.be

Blog Details:
http://tetraph.com/security/xss-vulnerability/about-group-about-com-main-pages-search-field-xss-cross-site-scripting-security-vulnerabilities/
http://securitypitch.com/about-group-about-com-content-network-vulnerable-to-xss-iframe-injection-security-attacks-433/
http://securityrelated.blogspot.com/2015/02/about-group-aboutcom-main-pages-search.html

(4) About Group About.com All Topics (At least 99.88% links) Vulnerable to Iframe Injection (Cross Frame Scripting) Security Attacks

Vulnerability description:
About Group has a security problem. It can be exploited by Iframe Injection (Cross Frame Scripting) attacks.

The vulnerability occurs at about.com “offsite.htm” page with “zu” parameter, e.g.

http://internationalinvest.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//facebook.com/yahoo

Use “http://whitehatpost.blog.163.com/” for the following test.

The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.

Vulnerable URLs:

http://homerenovations.about.com/od/fundingyourrenovation/tp/8-Remodels-That-Maximize-Curb-Appeal-For-Higher-Selling-Price.htm

http://publishing.about.com/od/Childrens-and-YA-Books/fl/A-Literary-linkedin-Agents-ebay-Advice-Hao123-to-Childrens-and-Bing-Sohu-YA-Dailymail-Authors-Snapdeal.htm

http://chinesefood.about.com/od/chickenrecipes/tp/chicken-stir-fry-flipkart-adobe-alipay-pork-dropbox-blogger-github-jd-chinadaily-huffingtonpost-Livedoor-Buzzfeed-Themeforest-Godaddy.htm

http://menshair.about.com/od/facialhair/qt/growbeard-ask-360cn-mailru-gmw-googleleadservices-bbc-pornhub-peoplecn-rakuten-nicovideo-dailymotion-1-dmm-deviantart.htm/

http://jobsearch.about.com/od/coverletters/a/types-sogou-outbrain-booking-chase-pixnet-reddit-pinterest-vk-msn-imdb-of-cover-qq-letters-bankofamerica-twitter-Wikia-Etsy.htm

http://testprep.about.com/od/The-Redesigned-PSAT/fl/Redesigned-PSAT-101-Flickr-Globo-Xnxx-Tudou-Yelp-Douban-Ameblo-33-Vimeo-Ettoday-Redtube-Directrev-Salesforce-Coccoc.htm

POC:

http://fictionwriting.about.com//gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//tetraph.com

http://internationalinvest.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//tetraph.com

http://inventors.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//itinfotechnology.wordpress.com

http://sbinformation.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//tetraph.com/security

http://ancienthistory.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//inzeed.com/security

http://specialchildren.about.com/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//diebiyi.com/security

http://womenshistory.about.com//gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//diebiyi.com/security

http://budgetdecorating.about.com/o/gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//diebiyi.com/security

http://makeup.about.com//gi/dynamic/offsite.htm?zi=1/XJ/Ya&sdn=internationalinvest&cdn=prep&tm=2&f=21&tt=14&bt=0&bts=1&zu=http%3A//diebiyi.com/security

POC Video:
https://www.youtube.com/watch?v=hx_sdDmSkg0&feature=youtu.be

Blog Details:
http://tetraph.com/security/iframe-injection/about-group-about-com-all-topics-at-least-99-88-links-vulnerable-to-iframe-injection-cross-frame-scripting-security-attacks/
http://securitypitch.com/about-group-about-com-content-network-vulnerable-to-xss-iframe-injection-security-attacks-433/
http://securityrelated.blogspot.com/2015/02/about-group-aboutcom-all-topics-at.html

(5) About (about.com) Open Redirect Multiple (Dest Redirect Privilege Escalation) Security Vulnerabilities

About Group online web application has a computer cyber security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker’s choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

Use one of webpages for the following tests. The webpage address is “http://www.inzeed.com/kaleidoscope/“. Suppose that this webpage is malicious.

Vulnerable URL 1:

http://www.about.com/snf.htm?u=http://www.instagram.com/facebook/craigslist

POC:

http://www.about.com/snf.htm?u=http://www.inzeed.com/essayjeans/poems/thatday.html

Vulnerable URL 2:

http://clk.about.com/?zi=13/1tO&ity=boostOrg&o=0&eng=boost&zu=http://paypal.com/imgur/xinhuanet

POC:

http://clk.about.com/?zi=13/1tO&ity=boostOrg&o=0&eng=boost&zu=http://www.inzeed.com/netflix/stackoverflow

Vulnerable URL 3:

http://wzus1.index.about.com/r?t=v&d=im&u=http%3A%2F%2Ft.co%2fxvideos%2fsoso%2f%naver%2fkickass.so

POC: