lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 12 Mar 2014 21:39:25 +0200
From: Project Zero Labs <>
To: <>
Subject: Byte CMS Cross Site Scripting Vulnerabilities

# Exploit Title: Byte CMS Cross Site Scripting Vulnerabilities
# Date: 02/03/2014
# Exploit Author: projectzero labs
# Projectzero ID:   projectzero2014-003-bytecmsxss
# Vendor Homepage:
# Software Link: N/A - Commercial
# Tested on: Kali Linux / Iceweasel v.22 & Mac OS X 10.8.5 / Firefox 

About the software:

Byte CMS is a commercial content management system developed by
BitsnBytes (

Vulnerability Details:

projectzero labs identified a cross site scripting vulnerability in 
variables of the Byte CMS software, which allows an attacker to execute
a dynamic script (e.g. JavaScript) in the context of the application.

This allows several different attack opportunities, mostly hijacking 
current session of the user or changing the look of the page by 
the HTML on the fly to steal the user's credentials. This happens
because the user input is interpreted as HTML/JavaScript by the 

Cross-site scripting targets the users of an application instead of the 
server. Although this is a limitation,
since it allows attackers to hijack other users' sessions, an attacker
could target an administrator in order to gain full control over the 

Proof Of Concept:

The cross site scripting vulnerability was found in many variables e.g. 
cid, images etc.The security issue might exist in additional variables 
but wasn't verified
due to the nature of the audit (black-box).

We must mention that the CMS applies a typical XSS filtering that can 
easily bypassed.

For the proof of concept we provide some of the vulnerable sites
with the XSS payload trigger:'"--></style></scRipt><scRipt>alert(0x0000DB)</scRipt>'"--></style></scRipt><scRipt>alert(0x0000BC)</scRipt>'"--></style></scRipt><scRipt>alert(0x000104)</scRipt>&w=300&h=23&a=0'"--></style></scRipt><scRipt>alert(0x000202)</scRipt>'"--></style></scRipt><scRipt>alert(0x000202)</scRipt>'"--></style></scRipt><scRipt>alert(0x000139)</scRipt>'"--></style></scRipt><scRipt>alert(0x00016B)</scRipt>&article=704&action=edit'"--></style></scRipt><scRipt>alert(0x000361)</scRipt>



Disclosure Timeline:
Vendor Contact:     23/12/2013 (Contacted vendor in person)
                     09/01/2014 (1st email - no response about the fix)
                     15/01/2014 (2nd email - no response about the fix)
                     02/03/2014 (Email to the site owners)
                     02/03/2014 Public Disclosure


projectzero labs

Project Zero Labs

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists