RunCMS XSS Vulnerability via User Agent
- From: Andrei Rimsa <rimsa@xxxxxxxx>
- Date: Wed, 7 Jul 2010 18:36:05 +0100
Title: RunCMS XSS Vulnerability via User Agent
Vendor: RunCMS
Product: RunCMS
Tested Version: 2.1
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares
===== Description =====
RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http request to a script within the forum module.
----- modules/forum/check.php -----
01: ...
10: echo "BROWSER: ".$_SERVER['HTTP_USER_AGENT'];
----- modules/forum/check.php -----
===== Impact =====
Malicious java script code can be executed in the context of the affected web site.
===== Proof of Concept =====
wget --user-agent="
" http://target/modules/forum/check.php
===== Workaround =====
Remove the affected file form the system: modules/forum/check.php.
===== Disclosure Timeline =====
June, 16 2010 - Vendor notification.
June, 17 2010 - Vendor response confirming the bug.
July, 07 2010 - Public disclosure.
===== References =====
http://www.runcms.org
_________________________________________________________________
Hotmail: Free, trusted and rich email service.
https://signup.live.com/signup.aspx?id=60969
- Prev by Date: ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities
- Next by Date: Sandbox 2.0.3 Multiple Remote Vulnerabilities
- Previous by thread: ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities
- Next by thread: Re: RunCMS XSS Vulnerability via User Agent
- Index(es):
Relevant Pages
|
