BugTraq
Micro CMS Persistent XSS Vulnerability. Oct 21 2010 01:36PM
SecPod Research (research secpod com)
Hi,

SecPod Research Team has found a Persistent Cross-Site vulnerability in
Micro CMS.

Advisory details has been attached to this mail.

Regards,
SecPod Research Team
http://www.secpod.com

########################################################################
######
Micro CMS Persistent Cross-Site Scripting Vulnerability.

SecPod Technologies (www.secpod.com)
Author Veerendra G.G
########################################################################
#######

SecPod ID: 1004 09/03/2010 Issue Discovered
09/05/2010 Vendor Notified
No Response from Vendor

Class: Persistent Cross-Site Scripting Severity: High

Overview:
---------
Micro CMS is prone to Persistent Cross-Site Scripting Vulnerability.

Technical Description:
----------------------
Micro CMS is prone to a Persistent Cross-Site vulnerability because it fails to
properly sanitize user-supplied input.

Input passed via the 'name' parameter(also in text-area) in a comment section
to "comments/send/" is not properly verified before it is returned to the
user. This can be exploited to execute arbitrary HTML and script code in a
user's browser session in the context of a vulnerable site. This may allow
the attacker to steal cookie-based authentication and to launch further attacks.

The exploit has been tested in Micro CMS 1.0 beta 1

Impact:
--------
Successful exploitation allows an attacker to execute arbitrary HTML and script
code in a user's browser session in the context of a vulnerable site.

Affected Software:
------------------
Micro CMS 1.0 beta 1 and prior

References:
-----------
http://www.micro-cms.com/
http://secpod.org/blog/?p=135
http://www.exploit-db.com/exploits/15147/
http://secpod.org/advisories/SECPOD_MicroCMS.txt

Proof of Concepts:
------------------
Add the following attack strings:
1. My XSS Test </legend><script> alert('XSS-Test')</script> <!--

OR

2. My XSS Test </legend><script> alert('XSS-Test')</script>

OR

3. <script> alert('XSS-Test')</script>

in "* Name" textbox in comment section and fill other sections properly.

NOTE : Some time above POC/Exploit will disable adding comments for that post.

Workaround:
-----------
Not available

Solution:
----------
Not available

Risk Factor:
-------------
CVSS Score Report:
ACCESS_VECTOR = NETWORK
ACCESS_COMPLEXITY = MEDIUM
AUTHENTICATION = NOT_REQUIRED
CONFIDENTIALITY_IMPACT = NONE
INTEGRITY_IMPACT = PARTIAL
AVAILABILITY_IMPACT = PARTIAL
EXPLOITABILITY = PROOF_OF_CONCEPT
REMEDIATION_LEVEL = UNAVAILABLE
REPORT_CONFIDENCE = CONFIRMED
CVSS Base Score = 5.8 (AV:N/AC:M/Au:NR/C:N/I:P/A:P)
CVSS Temporal Score = 5.2
Risk factor = High

Credits:
--------
Veerendra G.G of SecPod Technologies has been credited with the discovery of
this vulnerability.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus