------------------------------------------------------------------------ Cross-Site Scripting (XSS) in phpWebSite 1.4.0 search ------------------------------------------------------------------------ Author: Audun Larsen (larsen at xqus dot com) Date: Dec 29, 2007 --AFFECTED SOFTWARE-------------------------- Name: phpWebSite Version: 1.4.0 Release date: Dec 11, 2007 Developed by the Web Technology Group at Appalachian State University, phpWebSite provides a complete web site content management system ( CMS ). All client output is XHTML 1.0 and meets the W3C's Web Accessibility Initiative requirements. --DISCUSSION--------------------------------- The phpWebSite CMS is vulnerable to a Non-Persistent (or reflected) Cross-Site Scripting attack. The problem exists because of the lack of properly escaping user input before using it to generate links on the search result page. --PROOF OF CONCEPT--------------------------- http://phpwebsite.example.com/index.php?module=search&user=search &search=%22%3E%3Ch1%3EXSS%3C%2Fh1%3E&alternate=local&mod_title=all&submi t=Search --TIMELINE----------------------------------- Dec 29, 2007: Bug found Dec 29, 2007: Vendor notified DEc 31, 2007: Vendor reports that the bug is fixed Jan 1 , 2008: Posted to Bugtraq --DISCLAIMER--------------------------------- The information in this advisory and any of its demonstrations is provided "as is" without warranty of any kind. Copyright ? 2007 Audun Larsen, some rights reserved: http://creativecommons.org/licenses/by-sa/3.0/