prakash Posted June 12, 2007 Share Posted June 12, 2007 Fashion N' Fusker V1.0 script is based based on Fusker Technologies which use PHP & MySQL. According to Wikipedia "Fusker can be a verb, a noun that describes a technology for the web, or a noun that describes the output web page of that technology. As a verb, "to fusker" is to identify a range of images to a fusker script that returns a web page that displays all of the images within the range." The official site of this script is http://www.fashionsansar.com and I have installed the same script there. Please review it from your side. And if you have any comments, any bugs, or any feature to be added please post it here, PM me or use the contact from from the the above site. Thanks Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/ Share on other sites More sharing options...
agentsteal Posted June 12, 2007 Share Posted June 12, 2007 Array: http://www.fashionsansar.com/fas_fusk/tag_search.php?q[] Cross Site Scripting: http://www.fashionsansar.com/cgi-sys/scgiwrap/<marquee><h1>vulnerable</marquee> Cross Site Scripting: http://www.fashionsansar.com/fas_fusk/do_add_fusker.php?url="onmouseover=alert('vulnerable') Cross Site Scripting: http://www.fashionsansar.com/fas_fusk/image_view.php?id="onmouseover=alert('vulnerable') Cross Site Scripting: http://www.fashionsansar.com/fas_fusk/tag_search.php?q=<marquee><h1>vulnerable</marquee> Cross Site Scripting: There is Cross Site Scripting if you submit a search that contains code. Cross Site Scripting: There is Cross Site Scripting if you submit a URL that contains code. Cross Site Scripting: There is Cross Site Scripting on multiple pages if the URL contains ?">code. Full Path Disclosure: http://www.fashionsansar.com/?page=' Full Path Disclosure: http://www.fashionsansar.com/cgi-sys/scgiwrap/ Full Path Disclosure: http://www.fashionsansar.com/fas_fusk/tag_search.php?page=' Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/fasnsan/public_html/fas_fusk/tag_search.php on line 81 Full Path Disclosure: http://www.fashionsansar.com/fas_fusk/tag_search.php?page=99999999999 Full Path Disclosure: http://www.fashionsansar.com/fas_fusk/tag_search.php?q[] Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273454 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/fasnsan/public_html/fas_fusk/tag_search.php on line 81 MySQL error with Full Path Disclosure on this page: http://www.fashionsansar.com/fas_fusk/tag_search.php?page=' the bug is fixed Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273478 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 There is a Cross Site Scripting vulnerability in the url parameter in do_add_fusker.php: http://www.fashionsansar.com/fas_fusk/do_add_fusker.php?url="+onmouseover=alert(1337)+ bug fixed Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273493 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 Also in the id parameter in image_view.php: http://www.fashionsansar.com/fas_fusk/image_view.php?id="+onmouseover=alert(1337)+ This bug as has been fixed. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273503 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 Here's another xss: http://www.fashionsansar.com/fas_fusk/tag_search.php?q=<body background=//nukefreezone.net/archives/images/pwnd.jpg><marquee><h1>pwnd<br>by<br>agentsteal This Cross-site scripting has been fixed Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273505 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 Another SQL error with Full Path Disclosure: http://www.fashionsansar.com/?page=' This has been fixed. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273507 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 There is Cross Site Scripting if you submit a URL that contains code. Is anything missing in this reply??? Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273508 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 There is Cross Site Scripting if you do a search that contains code. again anything missing here. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273510 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/fasnsan/public_html/fas_fusk/tag_search.php on line 81 MySQL error with Full Path Disclosure on this page: http://www.fashionsansar.com/fas_fusk/tag_search.php?page=' the bug is fixed no it's still vulnerable: http://www.fashionsansar.com/fas_fusk/tag_search.php?page=99999999999 This bug as well as bug in http://www.fashionsansar.com/index.php?page=99999999999 has been fixed Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273513 Share on other sites More sharing options...
prakash Posted June 12, 2007 Author Share Posted June 12, 2007 You should block this file. It has Full Path Disclosure and Cross Site Scripting: http://www.fashionsansar.com/cgi-sys/scgiwrap ALL THE BUGS HAS BEEN FIXED TILL NOW EXCEPT THE ABOVE ONE Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273515 Share on other sites More sharing options...
prakash Posted June 13, 2007 Author Share Posted June 13, 2007 You should block this file. It has Full Path Disclosure and Cross Site Scripting: http://www.fashionsansar.com/cgi-sys/scgiwrap The CGI Script has been disabled. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273678 Share on other sites More sharing options...
prakash Posted June 13, 2007 Author Share Posted June 13, 2007 This page is still vulnerable in browsers that don't filter the URL (like Internet Explorer 6) Actually EVERY page on the site is vulnerable. POC: In IE6, add this code onto the end of any page's URL: ?"><marquee><h1>vulnerable<a SecFilter has been modified on modsecurity to fix the XSS possible vulnerable. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273825 Share on other sites More sharing options...
prakash Posted June 13, 2007 Author Share Posted June 13, 2007 All the bugs till now have been fixed please there is any more bugs and XSS please let me know. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273836 Share on other sites More sharing options...
prakash Posted June 13, 2007 Author Share Posted June 13, 2007 please also have a look for "Contact Us" and "SEND THIS PAGE", if there is any security hole for spammers. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273853 Share on other sites More sharing options...
prakash Posted June 13, 2007 Author Share Posted June 13, 2007 You can't run code on the pages anymore, but you can still write text on the pages in IE6 with: ?">text mmm ya but is there any other way to disable it??? I am not sure regarding it.. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-273963 Share on other sites More sharing options...
prakash Posted June 13, 2007 Author Share Posted June 13, 2007 Full Path Disclosure: http://www.fashionsansar.com/fas_fusk/tag_search.php?q[] This has been solved. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-274219 Share on other sites More sharing options...
prakash Posted June 14, 2007 Author Share Posted June 14, 2007 Full Path Disclosure: http://www.fashionsansar.com/fas_fusk/tag_search.php?q[] This has been solved. http://www.fashionsansar.com/fas_fusk/tag_search.php?q[]=test searches for Array instead of test. It's been fixed. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-274444 Share on other sites More sharing options...
prakash Posted June 14, 2007 Author Share Posted June 14, 2007 You can't run code on the pages anymore, but you can still write text on the pages in IE6 with: ?">text mmm ya but is there any other way to disable it??? I am not sure regarding it.. The problem is with the ? icon. The other icons aren't vulnerable because they put the URL into the link with location.href However, the last icon (?) actually writes the URL into the page. In http://fashionsansar.com/index.php?whatever, whatever goes into the source code: <a rel="nofollow" style="text-decoration:none;" href="http://fashionsansar.com/index.php?whatever" target="_Blank" title="Information" onMouseOver="schnapp('Information','','http://www.social-bookmark-script.de/img/bookmarks/what_trans_ani.gif',1)" onMouseOut="schnipp()" > <img style="padding-bottom:1px;" src="http://www.social-bookmark-script.de/img/bookmarks/what_trans.gif" alt="Information" name="Information" border="0" id="Information"> </a> If whatever is replaced with ">hello <a rel="nofollow" style="text-decoration:none;" href="http://fashionsansar.com/index.php?">hello" target="_Blank" title="Information" onMouseOver="schnapp('Information','','http://www.social-bookmark-script.de/img/bookmarks/what_trans_ani.gif',1)" onMouseOut="schnipp()" > <img style="padding-bottom:1px;" src="http://www.social-bookmark-script.de/img/bookmarks/what_trans.gif" alt="Information" name="Information" border="0" id="Information"> </a> "> closes the tag for the link and hello and the rest of the link get written onto the page. It's been fixed. All the above bugs and XSS have been fixed. Link to comment https://forums.phpfreaks.com/topic/55299-fashion-n-fusker-v10-please-review/#findComment-274473 Share on other sites More sharing options...
Recommended Posts