____________________________________________________________________________
____________________________________________________________________________

01010111 01001001 01010010 01000101 01000100  01010011 ->
01000101 01000011 01010101 01010010 01001001  01010100 ->
01011001                                                      

____________________________________________________________________________
ADVISORY: IFNET.IT WEBIF XSS VULNERABILITY
____________________________________________________________________________

_____________________
|| 0x00: ABOUT ME
|| 0x01: DATELINE
|| 0x02: INFORMATION
|| 0x03: EXPLOITATION
|| 0x04: GOOGLE DORK
|| 0x05: RISK LEVEL

____________________________________________________________
____________________________________________________________

_________________
|| 0x00: ABOUT ME

Author: SkyOut
Date: October 2007
Website: http://wired-security.net/

_________________
|| 0x01: DATELINE

2007-10-15: Bug found
2007-10-15: Email with notification sent to ifnet.it
2007-10-21: Still no reaction from ifnet.it
2007-10-22: Advisory released

____________________
|| 0x02: INFORMATION

In the WEBIF product by the italian company ifnet, an error
occurs due to the fact of an unfiltered variable (cmd) in the
webif.exe program. It is possible to execute any JavaScript code
by manipulating the parameter.

_____________________
|| 0x03: EXPLOITATION

To exploit this bug no exploit is needed, all can be done through
manipulation of the given URL:

STEP 1:
Go to the standard page of the WEBIF product, normally existing
at "/cgi-bin/webif.exe". You will recognize some further parameters,
being "cmd", "config" and "outconfig".

STEP 2:
Don't change any parameter instead of the "cmd" one. Change its value
to any JavaScript code you like. For our demo we will use the default
one, being "<script>alert('XSS');</script>".

STEP 3:
Click ENTER and execute the code. A successfull demonstration will
popup a window.

EXAMPLE:
http://example.com/webif/cgi-bin/webif.exe?cmd=<script>alert('XSS');</script>&config=[ * ]&outconfig=[ * ]

[ * ] = Depends on the server. Don't change this!

____________________
|| 0x04: GOOGLE DORK

inurl:"/cgi-bin/webif/" intitle:"WEBIF"

___________________
|| 0x05: RISK LEVEL

- LOW - (1/3) -

<!> Happy Hacking <!>

____________________________________________________________________________
____________________________________________________________________________

EOF