Phpmoneybooks 1.03 stored XSS and repair

Title: phpmoneybooks 1.03 Stored XSS
Author: chap0-chap0.blogspot.com-@ _ chap0
Official Website: http://phpmoneybooks.com/
: Http://sourceforge.net/projects/phpmoneybooks/files/phpMoneyBooks103.zip/download
Affected procedures: 1.03
 
Patch: upgrade to 1.04
 
Program introduction:
 
PhpMoneyBooks is an open sourced php/mysql program. A free alternative to QuickBooks.
 
Abstract:
Phpmoneybooks 1.03 is vulnerable to Stored XSS vulnerability enabling an attacker
 
To execute arbitrary JavaScript code withing the application. The vulnerability
 
Can be utilized when adding a new bank account or customer account. Users other
 
Then the admin account is able to input this information which in return can
 
Enable the super admin user to fall victim to this attack. The vulnerable index
 
Pages reside in/banks/index. php and/Mers MERs/index. php.
 

 
Stored XSS example
 

 
'> <Script> alert ('xss') </script>
 

Defect code
 
Www.2cto.com/banks/index. php
 

 
40 $ _ POST [AcctName] = trim ($ _ POST [AcctName]);
 
41 if (strtolower ($ row [1]) = strtolower ($ _ POST ['acctname']) {
 
42 echo "<script type = 'text/javascript '>
 
43 alert ('duplicate account: $ _ POST [AcctName] already exists .');
 
44 </script> ";
 
45 $ _ GET [action] = "AddForm ";
 

 

 
/Customers/index. php
 

 
36 if ($ _ GET [action] = "AddUser "){
 

 
37 $ query = "insert into phpMB_customers (AcctNo, DisplayName, CompanyName, MrMs, FirstName, MiddleIn, LastName, Contact, Phone, Phone2, Fax, Email, Rela
 
Tion, BillingAddress, ShippingAddress, Notes) VALUES ('$ _ POST [AcctNo]', '$ _ POST [DisplayName]', '$ _ POST [CompanyName]', '$ _ POST [MrMs]', '$ _ POST [FirstName]', '$ _ POST [MiddleIn]', '$ _ POST [LastName]', '$ _ POST [Contact]', '$ _ POST [Phone]', '$ _ POST [Phone2]', '$ _ POST [FAX]', '$ _ POST
 
[Email] ', 'customer',' $ _ POST [BillingAddress] ',' $ _ POST [ShippingAddress] ',' $ _ POST [Notes] ') ";
 

 
38 QueryMysql ($ query );
 
39 $ _ GET [action] = "";
 

 

 
By adding strip_tags to the strings in the php code allows the user input to be sanitized.
 

 
A couple of other vulnerabilities that exist in this application:
 

 
Usernames and passwords sent in clear text at log in.
 

 
The users cookie gets set as username and MD5 password of the user. With this if
 
Attacker inject javascript that steals cookies, the attacker will obtain the users username
 
And MD5 hashed password.
 

 
These two vulnerabilities are not fix, vendor was notified and is aware.