feebc6d466
Title : Shaarli Vulnerabilities Author : @erwan_lr | @_WPScan_ Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli Download : https://github.com/sebsauvage/Shaarli/archive/master.zip | http://sebsauvage.net/files/shaarli_0.0.40beta.zip Affected versions : master-705F835, 0.0.40-beta (versions below may also be vulnerable) Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards Persistent XSS : - During the instalation or configuration modification, the title field is vulnerable. e.g <script>alert(1)</script> Quotes can not be used because of var_export(), but String.fromCharCode works - The url field of a link is vulnerable : When there is no redirector : javascript:alert(1) Then, the code is triggered when a user click the url of a link Or with a classic XSS : "><script>alert(1)</script> Unvalidated Redirects and Forwards : A request with the param linksperpage or privateonly can be used to redirect a user to an arbitrary referer e.g GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1 Host: 127.0.0.1 Referer: https://duckduckgo.com History : March 2, 2013 - Vendor contacted
26 lines
1.2 KiB
HTML
26 lines
1.2 KiB
HTML
|
|
<div id="logo" title="Share your links !" onclick="document.location='?';"></div>
|
|
<div style="float:right; font-style:italic; color:#bbb; text-align:right; padding:0 5 0 0;" class="nomobile">Shaare your links...<br>
|
|
{if="!empty($linkcount)"}{$linkcount} links{/if}</div>
|
|
<span id="shaarli_title"><a href="?">{$shaarlititle|htmlspecialchars}</a></span>
|
|
|
|
{if="!empty($_GET['source']) && $_GET['source']=='bookmarklet'"}
|
|
{ignore} When called as a popup from bookmarklet, do not display menu. {/ignore}
|
|
{else}
|
|
<a href="?" class="nomobile">Home</a>
|
|
{if="isLoggedIn()"}
|
|
<a href="?do=logout">Logout</a><a href="?do=tools">Tools</a><a href="?do=addlink"><b>Add link</b></a>
|
|
{elseif="$GLOBALS['config']['OPEN_SHAARLI']"}
|
|
<a href="?do=tools">Tools</a><a href="?do=addlink"><b>Add link</b></a>
|
|
{else}
|
|
<a href="?do=login">Login</a>
|
|
{/if}
|
|
<a href="{$feedurl}?do=rss{$searchcrits}" class="nomobile">RSS Feed</a>
|
|
<a href="{$feedurl}?do=atom{$searchcrits}" style="padding-left:10px;" class="nomobile">ATOM Feed</a>
|
|
<a href="?do=tagcloud">Tag cloud</a>
|
|
<a href="?do=picwall{$searchcrits}">Picture wall</a>
|
|
<a href="?do=daily">Daily</a>
|
|
{/if}
|
|
<div class="clear"></div>
|
|
|
|
|