bugtraq - Re: XSS in CompactCMS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1104051915070.3407@forced.attrition.org>
Date: Tue, 5 Apr 2011 19:16:23 -0500 (CDT)
From: security curmudgeon <jericho@...rition.org>
To: advisory@...ridge.ch
Cc: bugtraq@...urityfocus.com
Subject: Re: XSS in CompactCMS

: Vulnerability ID: HTB22695
: Reference: http://www.htbridge.ch/advisory/xss_in_compactcms.html
: Product: CompactCMS
: Vendor: compactcms.nl ( http://www.compactcms.nl/ ) 
: Vulnerable Version: 1.4.1
: Vendor Notification: 04 November 2010 
: Vulnerability Type: XSS (Cross Site Scripting)
: Status: Fixed by Vendor
: Risk level: Low 
: Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 
: 
: Vulnerability Details:
: User can execute arbitrary JavaScript code within the vulnerable application.
: 
: The vulnerability exists due to failure in the "Comments" module to 
: properly sanitize user-supplied input in "website" variable. Successful 
: exploitation of this vulnerability could result in a compromise of the 
: application, theft of cookie-based authentication credentials, 
: disclosure or modification of sensitive data.
: 
: Attacker can create comment with special crafted website variable. The 
: following PoC is available:
: 
: http://host/?a="><script>alert("XSS");</script>

Can you confirm this is the correct PoC? This appears to be the "a" 
parameter and does not specify a script or module. Generally we would 
expect to see something more like:

http://[target]/index.php?&module=Comments&website=[XSS]