Back to list
PacerCMS Multiple Vulnerabilities (XSS/SQL)
Jan 22 2008 12:14PM
db rawsecurity org
PacerCMS Multiple Vulnerabilities (XSS/SQL).
PacerCMS is a content management solution for student and non-daily
PacerCMS is susceptible to both persistent cross-site scripting and
SQL injection attacks. An attacker could use the public
'Write a Letter'(submit.php) form to send a message to the System
headline, or text POST variables are not sufficiently sanitized.
The system administrator of the CMS sees a list of submitted
messages on siteadmin/index.php right after logging in. If an
headline then the code will be run as soon as the admin logs in.
This could lead to a staff member's session being hijacked.
Multiple siteadmin pages are vulnerable to SQL injection. Access to
these pages are restricted to staff members.
Example vulnerable code (article-edit.php)
$id = $_GET["id"];
$query = "SELECT * FROM cm_articles ";
$query .= " WHERE id = $id";
- Proof of Concept
Authors were notified of security issues and responded quickly.
Upgrade to the latest build (0.6.1).
Email: dB [at] rawsecurity ! org
[ reply ]
Copyright 2010, SecurityFocus