+------------------------------------------------------------------------------------------------------------------------------------+ # Exploit Title : SocialCMS <= 1.0.2 XSS (Persistent and Reflected) Vulnerabilities # Date : 30-03-2012 # Author : Ivano Binetti (http://www.ivanobinetti.com) # Vendor site : http://socialcms.com # Software link : http://sourceforge.net/projects/socialcms/files/latest/download # Version : 1.0.2 (and lower) # Tested on : Debian Squeeze (6.0) # CVE : CVE-2012-1982 # Original Advisory : http://www.webapp-security.com/2012/03/socialcms/ +------------------------------------------------------------------------------------------------------------------------------------+ Summary- 1)Introduction 2)Vulnerability Description 2.1 Persistent XSS 2.2 Reflected XSS 3)Exploit +------------------------------------------------------------------------------------------------------------------------------------+ 1)Introduction SocialCMS "is online software for developing dynamic websites.It allows non-technical users to create and make changes to a website easily. It can be used for setting up Company Website, Blog, Video site, Amazon shop, Membership Site, Adsense Site, Affiliate Review site, Twitter CMS or for Domain Monetization etc.". 2)Vulnerability Description 2.1 Persistent XSS SocialCMS 1.0.2 (and lower) is prone to a persistent XSS vulnerability due to an improper input sanitization of "TR_title" parameter, passed to "my_admin/admin1_list_pages.php" via http POST method. Exploiting this vulnerability an authenticated user - which is able to publish an article - could insert arbitrary code in web management interface "Title" field - under "my_admin/admin1_list_pages.php?id=<page_id>&action=edit" - that will be executed when an administrator - or another user - will browse that web page. 2.2 Reflected XSS The Improper input sanitization of "TR_title" parameter causes also a Reflected XSS for the user which inserts html/javascript code. 3)Exploit Insert the following code in "Title" field when you're creating a new page: "><script>alert(document.cookie)</script> +-----------------------------------------------------------------------------------------------------------------------------------+