104 lines
No EOL
3 KiB
Text
104 lines
No EOL
3 KiB
Text
##############################################################################
|
|
|
|
Title : Micro CMS Persistent Cross-Site Scripting Vulnerability.
|
|
Author : Veerendra G.G from SecPod Technologies (www.secpod.com)
|
|
Vendor : http://www.micro-cms.com/
|
|
Advisory : http://secpod.org/blog/?p=135
|
|
http://secpod.org/advisories/SECPOD_MicroCMS.txt
|
|
Version : Micro CMS 1.0 beta 1
|
|
Date : 09/28/2010
|
|
|
|
###############################################################################
|
|
|
|
SecPod ID: 1004 09/03/2010 Issue Discovered
|
|
09/05/2010 Vendor Notified
|
|
No Response from Vendor
|
|
|
|
|
|
Class: Persistent Cross-Site Scripting Severity: High
|
|
|
|
|
|
Overview:
|
|
---------
|
|
Micro CMS is prone to Persistent Cross-Site Scripting Vulnerability.
|
|
|
|
Technical Description:
|
|
----------------------
|
|
Micro CMS is prone to a Persistent Cross-Site vulnerability because it fails to
|
|
properly sanitize user-supplied input.
|
|
|
|
Input passed via the 'name' parameter(also in text-area) in a comment section
|
|
to "comments/send/" is not properly verified before it is returned to the
|
|
user. This can be exploited to execute arbitrary HTML and script code in a
|
|
user's browser session in the context of a vulnerable site. This may allow
|
|
the attacker to steal cookie-based authentication and to launch further attacks.
|
|
|
|
The exploit has been tested in Micro CMS 1.0 beta 1
|
|
|
|
|
|
Impact:
|
|
--------
|
|
Successful exploitation allows an attacker to execute arbitrary HTML and script
|
|
code in a user's browser session in the context of a vulnerable site.
|
|
|
|
|
|
Affected Software:
|
|
------------------
|
|
Micro CMS 1.0 beta 1 and prior
|
|
|
|
|
|
References:
|
|
-----------
|
|
http://www.micro-cms.com/
|
|
http://secpod.org/blog/?p=135
|
|
http://secpod.org/advisories/SECPOD_MicroCMS.txt
|
|
|
|
|
|
Proof of Concepts:
|
|
------------------
|
|
Add the following attack strings:
|
|
1. My XSS Test </legend><script> alert('XSS-Test')</script> <!--
|
|
|
|
OR
|
|
|
|
2. My XSS Test </legend><script> alert('XSS-Test')</script>
|
|
|
|
OR
|
|
|
|
3. <script> alert('XSS-Test')</script>
|
|
|
|
in "* Name" textbox in comment section and fill other sections properly.
|
|
|
|
NOTE : Some time above POC/Exploit will disable adding comments for that post.
|
|
|
|
|
|
Workaround:
|
|
-----------
|
|
Not available
|
|
|
|
|
|
Solution:
|
|
----------
|
|
Not available
|
|
|
|
|
|
Risk Factor:
|
|
-------------
|
|
CVSS Score Report:
|
|
ACCESS_VECTOR = NETWORK
|
|
ACCESS_COMPLEXITY = MEDIUM
|
|
AUTHENTICATION = NOT_REQUIRED
|
|
CONFIDENTIALITY_IMPACT = NONE
|
|
INTEGRITY_IMPACT = PARTIAL
|
|
AVAILABILITY_IMPACT = PARTIAL
|
|
EXPLOITABILITY = PROOF_OF_CONCEPT
|
|
REMEDIATION_LEVEL = UNAVAILABLE
|
|
REPORT_CONFIDENCE = CONFIRMED
|
|
CVSS Base Score = 5.8 (AV:N/AC:M/Au:NR/C:N/I:P/A:P)
|
|
CVSS Temporal Score = 5.2
|
|
Risk factor = High
|
|
|
|
Credits:
|
|
--------
|
|
Veerendra G.G of SecPod Technologies has been credited with the discovery of
|
|
this vulnerability. |