Dropsafe

by Alec Muffett

[Full-disclosure] phpMyBible 0.5.1 Multiple XSS #security #xss

There are days I love information security:

# Exploit Title: phpMyBible 0.5.1 Mutiple XSS
# Date: 04/15/12
# Author: G13
# Twitter: @g13net
# Software http://sourceforge.net/projects/phpmybible/?source=directory
# Version: 0.5.1
# Category: webapps (php)
#

##### Description #####

phpMyBible is an online collaborative project to make an e-book of the Holy Bible in as various language as possible. phpMyBible is designed to be flexible to all readers while maintaining the authenticity and originality of the Holy Bible scripture.

##### Vulnerability #####

phpMyBible has multiple XSS vulnerabilities.

When reading a section of the Bible; both the 'version' and 'chapter' variables are prone to reflective XSS.

##### Exploit #####

http://localhost/index.php?book=1&version=[XSS]&chapter=[XSS]

##### Vendor Notification #####

04/15/12 - Vendor Notified
04/22/12 - No response, disclos

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

⊞

Comments

2 responses to “[Full-disclosure] phpMyBible 0.5.1 Multiple XSS #security #xss”

  1. Dave Walker

    So we can finally have “the Gospel according to St Hunter”, then – Iain Banks will likely be amused ;-).

    Hmm – “phpMyBible is designed to be flexible to all readers while maintaining the authenticity and originality of the Holy Bible scripture”. While interpreting this statement naturally involves considerable mental flexibility, I assume a) the default language is Aramaic, b) in the same vein that unbowdlerised editions of Shakespeare are considered the most valuable, this is an undeuteronomised text (including such items as Paul’s 3rd letter to the Corinthians, the Gospel according to Peter, etc)?

    Reply
  2. Simon

    “Full-Disclosure – We believe in it.”

    Sounds like Xtian hackers in this context.

    I can only find one instance of phpMyBible deployed, and it looks like it was deployed by the author. I can find lots of mirror sites, and even more sites reporting the XSS issue. Your best chance for exploiting this is a site accidentally running PHP in a mirror of the git archives. We’ve got ridiculously good at distributing, and reporting problems in bad software no one uses.

    Oh and yes parameters are passed through unchanged.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts