[CVE-2012-3872] Openconstructor CMS 3.12.0 Multiple Reflected- Cross-site Scrpting vulnerabilities

From: lorenzo.cantoni86@gmail.com
To: bugtraq@securityfocus.com
Cc:
Subject: [CVE-2012-3872] Openconstructor CMS 3.12.0 Multiple Reflected- Cross-site Scrpting vulnerabilities
Date:


###Title###: 
Openconstructor CMS 3.12.0 Multiple Reflected Cross-site Scrpting vulnerabilities


###Affected Software###:
http://www.openconstructor.org/
http://code.google.com/p/openconstructor/downloads/list
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234


###Description###: 
Openconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP. Multiple Reflected XSS vulnerabilities exist on different parameters of differnt pages. 
Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested.


###CVE###
CVE-2012-3872


###Impact###: 
Attackers can execute malicious javascript in authenticated users's browser, through social engineering techniques.

CVSS Base Score: 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N)


###Credits###:
Lorenzo Cantoni 


###Details###:
Vulnerabilities has been tested on Internet Explorer 7, as the application is designed to work with that browser. Newer version of the browser with the anti-xss filter enabled, may help to protect users from such attacks.


###Proof of Concept###:

1) http://hostname/openconstructor/data/file/edit.php?result=<script>alert('xss')</script>&id=new&ds_id=8&hybridid=&fieldid=&callback=&type=txt&name=test&description=test&fname=test&create=Save

Note: The right 'ds_id' must be set for an existing object. 

2) http://hostname/openconstructor/confirm.php?q=<script>alert('XSS')</script>skin=metallic

3) http://hostname/openconstructor/users/users.php?type=multiple&keyword=<script>alert('xss')</script>


###Disclosure###
[08/07/2012] Lead Developer contacted.
[22/07/2012] No response. Sent another mail.
[04/08/2012] Still no response. Public disclosure.





Copyright © 1995-2019 LinuxRocket.net. All rights reserved.