chicomas <=2.0.4 Multiple Vulnerabilities

2009-01-07 / 2009-01-08
Credit: bugreport
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-264


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

########################## www.BugReport.ir ######################### # # AmnPardaz Security Research Team # # Title: chicomas <=2.0.4 Multiple Vulnerabilities # Vendor: http://www.chicomas.com/ # Demo: http://demo.opensourcecms.com/chicomas # Bug: Database Information Disclosure, Authorization Weakness, XSS # Vulnerable Version: 2.0.4 # Exploitation: Remote with browser # Fix: N/A # Original Advisory: http://www.bugreport.ir/index_59.htm ################################################################### #################### - Description: #################### ChiCoMaS is free web based Content Management System based on PHP & MySQL with Full featured WYSIWYG TinyMCE editor, File management with QuiXplorer, User and group administration to manage access permissions & Backup/Restore with integrated MySqlBackupPro. #################### - Vulnerability: #################### +-->Dtabase Information Disclosure POC: http://[URL]/chicomas/config.inc +-->The Latest generated Database backups POC: http://[URL]/chicomas/backup +-->Cross Site Scripting (XSS). Reflected XSS attack in "index.php" in "q" parameter. POC: http://[URL]/chicomas/index.php?q="<script>alert(/www.BugReport.ir/.sour ce)</script> #################### - Solution: #################### Restrict and grant only trusted users access to the resources. Edit the source code to ensure that inputs are properly sanitized. #################### - Credit : #################### AmnPardaz Security Research & Penetration Testing Group Contact: admin[4t}bugreport{d0t]ir www.BugReport.ir www.AmnPardaz.com

References:

http://www.securityfocus.com/archive/1/archive/1/499458/100/0/threaded


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top