TUCoPS :: HP Unsorted S :: b1a-1476.htm

SimpGB Cross-Site Scripting vulnerabilities
Cross-Site Scripting vulnerabilities in SimpGB
Cross-Site Scripting vulnerabilities in SimpGB

Hello Bugtraq!

I want to warn you about security vulnerabilities in SimpGB.

Earlier I already wrote about other vulnerabilities in SimpGB -
SecurityVulns ID: 10412 (http://securityvulns.ru/news/CGI/2009.11.19.html). 

Advisory: Cross-Site Scripting vulnerabilities in SimpGB
URL: http://websecurity.com.ua/4252/ 
Affected products: SimpGB V1.37.3 and previous versions. As I checked, in
SimpGB v1.49.01 there still is XSS via Flash.

26.10.2009 - found vulnerabilities.
01.06.2010 - announced at my site.
02.06.2010 - informed developer.
14.07.2010 - disclosed at my site.

These are Cross-Site Scripting (persistent XSS) vulnerabilities.


There are persistent XSS in three functionalities of web application.

POST request at pages:


In field Name.

[swf width=1 height=1]http://site/flash.swf[/swf] 
In field Text.

The attack is possible on old versions of flash player, where there was less
strict security policy and it was possible to execute JS-code from flash
files from external sites. In 9 and next versions of flash player the attack
will work only if swf-file will be at the same domain.

Best wishes & regards,
Administrator of Websecurity web site

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH