feebc6d466
Title : Shaarli Vulnerabilities Author : @erwan_lr | @_WPScan_ Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli Download : https://github.com/sebsauvage/Shaarli/archive/master.zip | http://sebsauvage.net/files/shaarli_0.0.40beta.zip Affected versions : master-705F835, 0.0.40-beta (versions below may also be vulnerable) Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards Persistent XSS : - During the instalation or configuration modification, the title field is vulnerable. e.g <script>alert(1)</script> Quotes can not be used because of var_export(), but String.fromCharCode works - The url field of a link is vulnerable : When there is no redirector : javascript:alert(1) Then, the code is triggered when a user click the url of a link Or with a classic XSS : "><script>alert(1)</script> Unvalidated Redirects and Forwards : A request with the param linksperpage or privateonly can be used to redirect a user to an arbitrary referer e.g GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1 Host: 127.0.0.1 Referer: https://duckduckgo.com History : March 2, 2013 - Vendor contacted |
||
|---|---|---|
| .. | ||
| addlink.html | ||
| changepassword.html | ||
| changetag.html | ||
| configure.html | ||
| daily.html | ||
| dailyrss.html | ||
| editlink.html | ||
| export.html | ||
| import.html | ||
| includes.html | ||
| install.html | ||
| linklist.html | ||
| linklist.paging.html | ||
| loginform.html | ||
| page.footer.html | ||
| page.header.html | ||
| page.html | ||
| picwall.html | ||
| picwall2.html | ||
| readme.txt | ||
| tagcloud.html | ||
| tools.html | ||
===== Shaarli template organisation =====
Any Shaarli page should conform to this RainTPL template:
-----------------------------------------------------
<html>
<head>{include="includes"}</head>
<body>
<div id="pageheader">{include="page.header"}</div>
You body goes here...
{include="page.footer"}
</body>
</html>
-----------------------------------------------------
If you want to also add something in the page header (in the dark area), do it here:
<div id="pageheader">{include="page.header"}My menu goes here...</div>
Example: "Add new link" form:
-----------------------------------------------------
<html>
<head>{include="includes"}</head>
<body onload="document.addform.post.focus();">
<div id="pageheader">
{include="page.header"}
<div id="headerform">
<form method="GET" action="" name="addform" class="addform">
<input type="text" name="post" style="width:50%;">
<input type="submit" value="Add link" class="bigbutton">
</form>
</div>
</div>
{include="page.footer"}
</body>
</html>
-----------------------------------------------------