eXV2 Content Management System 2.10 Remote XSS Vulnerability

2010.11.04
Credit: LiquidWorm
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

? eXV? Content Management System 2.10 Remote XSS Vulnerability Vendor: eXV? Team Product web page: http://www.exv2.de Affected version: 2.10 (LiveCD) Summary: eXV? is a free CMS for building and operating private home pages, small and large communities and it's also easily used for small to medium business presences. Desc: The CMS suffers from a remote reflected Cross-Site Scripting vulnerability when input passed thru "rssfeedURL" and "sumb" parameter in "archive.php", "topics.php", "example.php" and "index.php" is not sanitized, allowing the attacker to execute arbitrary HTML and script code in a user's browser session and aid in phishing attacks. Tested on: Microsoft Windows XP Pro (EN) Apache 2.2.14 (Win32) MySQL 5.1.41 PHP 5.3.1 Vendor status: [09.10.2010] Vulnerability discovered. [10.10.2010] Contact with the vendor. [14.10.2010] No reply from vendor. [15.10.2010] Public advisory released. Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic liquidworm gmail com Zero Science Lab - http://www.zeroscience.mk Advisory ID: ZSL-2010-4970 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4970.php PoC: http://127.0.0.1:4001/manual/caferss/example.php?rssfeedURL="%20onmouseover=prompt(1)%20xss="&submit=OK http://127.0.0.1:4001/modules/news/archive.php?subm="><script>alert(1)</script> http://127.0.0.1:4001/modules/news/topics.php?subm="><script>alert(1)</script> http://127.0.0.1:4001/modules/contact/index.php?op=contact&subm="><script>alert(1)</script>

References:

http://xforce.iss.net/xforce/xfdb/62630
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4970.php
http://www.securityfocus.com/bid/44169
http://www.packetstormsecurity.com/1010-exploits/exv2-xss.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top