bugtraq - [MajorSecurity Advisory #45]oe2edit CMS - Cross Site Scripting and Cookie Manipulation Issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070415071902.23603.qmail@securityfocus.com>
Date: 15 Apr 2007 07:19:02 -0000
From: admin@...orsecurity.de
To: bugtraq@...urityfocus.com
Subject: [MajorSecurity Advisory #45]oe2edit CMS - Cross Site Scripting
 and Cookie Manipulation Issue

[MajorSecurity Advisory #45]oe2edit CMS - Cross Site Scripting and Cookie Manipulation Issue

Details
=======
Product: oe2edit CMS
Security-Risk: moderated
Remote-Exploit: yes
Vendor-URL: http://www.oe2edit.com
Vendor-Status: informed
Advisory-Status: published

Credits
============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de

Original Advisory:
============
http://www.majorsecurity.de/index_2.php?major_rls=major_rls45

Introduction
============
oe2edit is a German Content Management System.

More Details
============
Cross Site Scripting:
Input passed directly to the "q" parameter in "oe2edit.cgi" is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Cookie Manipulation:
Input passed directly to the "q" parameter in "oe2edit.cgi" is not properly sanitised before being returned to the user.
This can be exploited to inject custom META tags to alter the cookies stored in the browser, set custom cookies and to modify the cookie information. 

Workaround
=============
Edit the source code to ensure that input is properly sanitised.
You should work with "htmlspecialchars()" or "htmlentities()" php-function to ensure that html tags
are not going to be executed. 

Example:
$q = htmlspecialchars($_POST['q']);
$test = htmlentities($_GET['test']);
?>

History/Timeline
================
07.04.2007 discovery of the vulnerability
08.04.2007 additional tests with other versions
09.04.2007 contacted the vendor
15.04.2007 advisory is written
15.04.2007 advisory released

MajorSecurity
=======
MajorSecurity is a non-profit German penetration testing and security research project
which consists of only one person at the present time.
http://www.majorsecurity.de/