Search | Research | Contact Us Monday April 17, 2022
Languages
Most Viewed Items
  1 PHPXMLRPC Library Remote Code Execution
  2 Multiple Invision Power Board Vulnerabilities
  3 XOOPS 2.0.11 && Earlier Multiple Vulnerabilities
  4 eBay And Amazon Still Vulnerable
  5 When Small Mistakes Can Cause Big Problems
  6 Woltlab Burning Board SQL Injection Vulnerability
  7 Multiple Vulnerabilities In phpWebsite
  8 WordPress 1.5.1.2 And Earlier Multiple Vulnerabilities
  9 Document Object Model Hijacking Explained
10 Critical Vulnerability In Help Center Live
Need Secure Code?
Quick Search
You can use the form below to search our site. Just enter the keywords to search.
Home Services Archives Research Downloads Contact
Cross Site Scripting In Psychostats
December 22, 2021
Vendor : Jason Morriss
URL : http://www.psychostats.com/
Version : PsychoStats 2.2.4 Beta && Earlier
Risk : Cross Site Scripting


Description:
PsychoStats is a statistics generator for games. Currently there is support for a handful of Half-Life "MODs" including Counter-Strike, Day of Defeat, and Natural Selection. PsychoStats gathers statistics from the log files that game servers create by reading through the logs and then calculating detailed statistics for players, maps, weapons and clans. These detailed statistics are stored in a MySQL database which are then viewed online from your website using a set of PHP web pages. There are some complaints out there in the community that do not like the fact that PsychoStats does not provide 'real time' game statistics. The fact is, providing 'real time', accurate and detailed statistics is a hard issue to overcome. Some game statistic generators out there that provide 'real time' statistics simply do not have the same amount of detailed information that PsychoStats has. And they usually only provide very basic 'kill' statistics. Ignoring detailed 'map' and 'clan' statistics. PsychoStats may not be real time, but it works very close to it. As data is stored in a mysql database old logs that were scanned previously do not need to be scanned again, which makes for much faster updates then the old v1.x of PsychoStats. And the data provided by PsychoStats is very detailed.


Cross Site Scripting:
Cross site scripting exists in Jason Morriss PsychoStats. This vulnerability exists due to user supplied input not being checked properly. Below is an example.

http://www.example.com/stats/login.php?login=%22%3E%3Ciframe%3E

This vulnerability could be used to steal cookie based authentication credentials within the scope of the current domain, or render hostile code in a victim's browser.


Solution:
The vendor was contacted, responded very promptly and said he will be addressing the issue soon and has released an updated version of the software.

http://www.psychostats.com/forums/viewtopic.php?t=11022

You can find directions on how to install the patch at the link listed above. Users should upgrade as soon as they can.


Credits:
James Bercegay of the GulfTech Security Research Team