Hello Bugtraq! I want to warn you about multiple vulnerabilities in XAMPP. I disclosed at my site multiple vulnerabilities in XAMPP in 2009 (in total 7 advisories). And informed developers about them. Also I published these vulnerabilities at securityvulns.ru (securityvulns.com). And now I'm informing you about them. I will combine 7 advisories in 4 letters to mailing list. ----------------------------- Advisory #1 ----------------------------- Cross-Site Scripting vulnerability in XAMPP ----------------------------- URL: http://websecurity.com.ua/3220/ ----------------------------- Timeline: 09.12.2008 - found the vulnerability. 10.06.2009 - disclosed at my site. 11.06.2009 - informed developers. ----------------------------- Details: This is Cross-Site Scripting vulnerability. XSS: Vulnerability in xamppsecurity.php. http://websecurity.com.ua/uploads/2009/XAMPP%20XSS.html Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next versions (including last version XAMPP 1.7.1). ----------------------------- Advisory #2 ----------------------------- Multiple vulnerabilities in XAMPP ----------------------------- URL: http://websecurity.com.ua/3230/ ----------------------------- Timeline: 11.06.2009 - found the vulnerabilities. 13.06.2009 - announced at my site. 14.06.2009 - informed developers. 16.07.2009 - disclosed at my site. ----------------------------- Details: These are Predictable Resource Location, Information Leakage, Cross-Site Scripting and Directory Traversal vulnerabilities. Predictable Resource Location: There are standard paths to resources in XAMPP, which can be used for attack. http://site/security/ - security service of XAMPP http://site/xampp/ - admin panel of XAMPP http://site/phpmyadmin/ - PhpMyAdmin http://site/webalizer/ - Webalizer Information Leakage: http://site/webalizer/ Access to Webalizer is not restricted and taking into account that path to the resource is known, anyone can gain access to statistic of the site, which can lead to considerable information leakage, including about different resources at the site. Information Leakage: http://site/security/ Security service of XAMPP (XAMPP SECURITY [Security Check 1.0]), if access to it is opened, leads to information leakage. It shows information about version of PHP and about status of components of XAMPP, particularly PhpMyAdmin. XSS: http://site/xampp/showcode.php?TEXT[global-showcode]=%3Cscript%3Ealert(document.cookie)%3C/script%3E Directory Traversal: http://site/xampp/showcode.php?showcode=1&file=../index.php Works with register globals on. Vulnerable are XAMPP 1.6.8 and previous versions. And potentially next versions (including last version XAMPP 1.7.1). ----------------------------- Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
