imei Addmimistrator’s BugBlog

——————-Summary—————-
Software: Olate Download
Sowtware’s Web Site: http://www.olate.co.uk/
Versions: 3.4.2
Class: Remote
Status: Patched
Exploit: Available
Solution: Not Available
Discovered by: imei addmimistrator
Risk Level: Middel
—————–Description—————
Olate download is prone to Cross site scripting, cause of simple code replacing for comments in mentioned file
bug is in line about 231, that programmers simply replaced some patterns with some equivalents.
Usually, phrasing codes are a complicated process especially if there was more codes and more cases. codes embedded into HTML tags, are more dangerous. I’m approximately sure that there is no reasonable solution but using Regular Expression for this propose. In this case, 3 other codes phrased using str_replace() function that is very weaker than preg_replace().
Look at the related code:
$comment['comment'] = preg_replace(’/\[url\](.*)\[\/url\]/si’,’$1‘,$comment['comment']);
Even in this using of preg_replace, using a weak pattern (.*) results to a simple XSS bug.
————–Exploit———————-
comment this at a desired file detail:
[url]javascript:alert(1)[/url]
———–Solution———————
update to 3.4.3
————–Credit———————–
Discovered by: imei addmimistrator
addmimistrator(4}gmail(O}com
www.myimei.com

Posted by imei on Wednesday, August 22nd, 2007 at 9:17 pm.