Development @spooxe

Gestaltung und Entwicklung mit PHP, Yii, Perl, MVC, XML/XSLT, MySQL, HTML, JavaScript, CSS, Photoshop und vielen anderen Werkzeugen seit 1994.

Das Webdesign meiner Homepage ist mit Bootstrap erstellt. Eingesetzt wurden die Komponenten Tooltip, Navbar und Modal. Insgesamt ein minimalistisch gehaltenes Webdesign.

I found this old message nightly on my work  (different Perl modules are to install without having Root rights).

Details
=======
Product: eXV2.de CMS <= 2.0.5.
Severity: moderated
Remote-Exploit: yes
Vendor-URL: http://www.exv2.de/
Vendor-Status: informed
Advisory-Status: published


Credits
============
Discovered by: Vision aka n-tier
http://www.i-s-o.org

Original Advisory:
============
http://n-tier.i-s-o.org

Introduction
============
eXV2.de CMS is a Content Management System.

More Details
============
1. Cross Site Scripting:
Input passed directly to the "set_lang" parameter in the Browser Cookie is not properly sanitised before being returned to the user.
A user can sent a cookie to himself with ?/set_lang=deutsch and edit it. 
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Workaround: [Cross Site Scripting]
=============
Edit the source code to ensure that input is properly sanitised.


Example:

$my_Cookie_Vars =  $_COOKIE;

if (isset($my_Cookie_Vars['set_lang'])){
    if (($my_Cookie_Vars['set_lang'] == "deutsch")||($my_Cookie_Vars['set_lang'] == "english")||($my_Cookie_Vars['set_lang'] == "french")) {                      
        }  else {
            $abuse = true;
            $xoopsConfig['language'] = $xoopsConfig['default_language'];                
        }   
}  


if ($abuse){
    die("The desired action could not be performed.");
}



History/Timeline
================
11.08.2007 discovery of the vulnerabilitie
11.08.2007 additional tests with other versions
13.08.2007 contacted the vendor

Is important to import a file from your asset folder for input with the assetManager. Nothing else works at me. I try a script objLoader to import a cube.obj with the try:

 

        try { //try to open file
            reader = new BufferedReader(new InputStreamReader(new FileInputStream(fileName)));
        }

 this sucks completely.

Now i do that:

Open an asset using ACCESS_STREAMING mode. This provides access to files that have been bundled with an application as assets -- that is, files placed in to the "assets" directory.

AssetManager assetManager = getAssets();
              
        // To load text file
        InputStream input;
        try {
            input = assetManager.open("cube.obj");
            
             int size = input.available();
             byte[] buffer = new byte[size];
             input.read(buffer);
             input.close();

             // byte buffer into a string
             String text = new String(buffer);
            
             txtContent.setText(text);
        }

 Thats is it.