Seditio Cross Site Scripting Vulnerability

2006-05-30 / 2006-05-31

Credit: Yunus Emre Yilmaz

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2006-2634

CWE: CWE-79

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

Advisory      : Cross Site Scripting in Seditio (http://www.neocrome.net)

Release Date  : 24/05/2005

Last Modified : 24/05/2005

Author        : Yunus Emre Yilmaz ( http://yns.zaxaz.com)

Application   : Seditio v102 ( maybe older versions)

Risk          : Critical

Problem :

Ldu's logging all referer info for administrator.If an attacker change the referer value with malicious

js codes, the code will be executed in administration page.Referer info is coming from user and can be changed as everything.

Proof Of Concept :

I wrote a simple exploit which can be downloaded from here : http://yns.zaxaz.com/exploits/seditio-exploit.rar

Solution :

I wrote an unofficial security patch which can be downloaded from here : http://yns.zaxaz.com/security-patches/security-patches-seditio-v102-xss-
patch.rar

(For offical patches : www.neocrome.net)

Original Advisory :

http://yns.zaxaz.com/advisories/seditio.txt

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Seditio Cross Site Scripting Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.