bugtraq - [CVE-2012-3872] Openconstructor CMS 3.12.0 Multiple Reflected Cross-site Scrpting vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201208040825.q748PG4v026453@sf01web3.securityfocus.com>
Date: Sat, 4 Aug 2012 08:25:16 GMT
From: lorenzo.cantoni86@...il.com
To: bugtraq@...urityfocus.com
Subject: [CVE-2012-3872] Openconstructor CMS 3.12.0 Multiple Reflected
 Cross-site Scrpting vulnerabilities

###Title###: 
Openconstructor CMS 3.12.0 Multiple Reflected Cross-site Scrpting vulnerabilities

###Affected Software###:
http://www.openconstructor.org/
http://code.google.com/p/openconstructor/downloads/list
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234

###Description###: 
Openconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP. Multiple Reflected XSS vulnerabilities exist on different parameters of differnt pages. 
Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested.

###CVE###
CVE-2012-3872

###Impact###: 
Attackers can execute malicious javascript in authenticated users's browser, through social engineering techniques.

CVSS Base Score: 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N)

###Credits###:
Lorenzo Cantoni 

###Details###:
Vulnerabilities has been tested on Internet Explorer 7, as the application is designed to work with that browser. Newer version of the browser with the anti-xss filter enabled, may help to protect users from such attacks.

###Proof of Concept###:

1) http://hostname/openconstructor/data/file/edit.php?result=<script>alert('xss')</script>&id=new&ds_id=8&hybridid=&fieldid=&callback=&type=txt&name=test&description=test&fname=test&create=Save

Note: The right 'ds_id' must be set for an existing object. 

2) http://hostname/openconstructor/confirm.php?q=<script>alert('XSS')</script>skin=metallic

3) http://hostname/openconstructor/users/users.php?type=multiple&keyword=<script>alert('xss')</script>

###Disclosure###
[08/07/2012] Lead Developer contacted.
[22/07/2012] No response. Sent another mail.
[04/08/2012] Still no response. Public disclosure.