Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Exponent Slideshow XSS Vulnerability

  Pligg Installation File XSS Vulnerability

  ArtForms 2.1b7.2 RC2 Joomla Component Multiple Remote Vulnerabilities

  MODx Installation File XSS Vulnerability

From:Andrei Rimsa <rimsa_(at)_live.com>
Date:8 июля 2010 г.
Subject:RunCMS XSS Vulnerability via User Agent


Title: RunCMS XSS Vulnerability via User Agent
Vendor: RunCMS
Product: RunCMS
Tested Version: 2.1
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares

===== Description =====

RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http request to a script within
the forum module.

----- modules/forum/check.php -----
01: ...
10: echo "BROWSER: ".$_SERVER['HTTP_USER_AGENT'];
----- modules/forum/check.php -----

===== Impact =====

Malicious java script code can be executed in the context of the affected web site.

===== Proof of Concept =====

wget --user-agent="

" http://target/modules/forum/check.php

===== Workaround =====

Remove the affected file form the system: modules/forum/check.php.

===== Disclosure Timeline =====

June, 16 2010 - Vendor notification.
June, 17 2010 - Vendor response confirming the bug.
July, 07 2010 - Public disclosure.

===== References =====

http://www.runcms.org                                     
_________________________________________________________________
Hotmail: Free, trusted and rich email service.
https://signup.live.com/signup.aspx?id=60969

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород