bugtraq - Re: RunCMS XSS Vulnerability via User Agent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Jul 2010 22:58:27 -0000
From: rimsa@...e.com
To: bugtraq@...urityfocus.com
Subject: Re: RunCMS XSS Vulnerability via User Agent

Html tags were removed from the advisory during the submission process. Hopefully the following advisory will correct this.

Title: RunCMS XSS Vulnerability via User Agent
Vendor: RunCMS
Product: RunCMS
Tested Version: 2.1
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares

===== Description =====

RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http request to a script within the forum module.

----- modules/forum/check.php -----
01: <?php
    ...
10:          echo "BROWSER: ".$_SERVER['HTTP_USER_AGENT'];
----- modules/forum/check.php -----

===== Impact =====

Malicious java script code can be executed in the context of the affected web site.

===== Proof of Concept =====

wget --user-agent="<script>window.alert('XSS');</script>" http://target/modules/forum/check.php

===== Workaround =====

Remove the affected file form the system: modules/forum/check.php.

===== Disclosure Timeline =====

June, 16 2010 - Vendor notification.
June, 17 2010 - Vendor response confirming the bug.
July, 07 2010 - Public disclosure.

===== References =====

http://www.runcms.org