Vulnerabilities in IB Promotion Advanced Business Web Suite Sep 20 2010 03:53PM
MustLive (mustlive websecurity com ua)
Hello Bugtraq!

I want to warn you about Cross-Site Scripting and Insufficient
Anti-automation vulnerabilities in IB Promotion Advanced Business Web Suite.
It's Ukrainian commercial CMS.

XSS (WASC-08):


It's DOM Based XSS.

Insufficient Anti-automation (WASC-21):


At these pages there is no protection from automated requests.

Affected products:

IB Promotion Advanced Business Web Suite v1.0, IB Pro CMS v1.0 and IB Pro
CMS v2.0. IB Promotion Advanced Business Web Suite - it's previous name of
system IB Pro CMS.


2010.06.22 - informed admin of the site, where I found vulnerabilities.
2010.06.23 - announced at my site.
2010.06.24 - informed developers of CMS.
2010.09.09 - disclosed at my site. Both admin of vulnerable site and
developers (in their engine and at their own site) didn't fix the holes.

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus