e107 CMS 1.0.2 Cross Site Scripting

`TC-SA-2013-01: Reflected Cross-Site-Scripting (XSS) vulnerability   
in e107 CMS v1.0.2  
  
Published: 2013/04/03  
Version 1.0  
  
Affected Products:  
e107 version 1.0.2 (others not tested)  
http://www.e107.org  
  
References:  
TC-SA-2013-01 www.tele-consulting.com/advisories/TC-SA-2013-01.txt   
(used for updates)  
CVE-2013-2750 - Reflected Cross-Site-Scripting (XSS) vulnerability   
in e107 CMS v1.0.2  
  
Summary:  
"e107 is a free (open-source) content management system allowing   
you to easily manage and publish your content. Developers can   
save time in building websites and powerful online applications.  
Users can avoid programming completely!" (www.e107.org)   
The content_preset.php Script in e107 CMS is vulnerable to   
reflected Cross-Site-Scripting (XSS) attacks. Malicious code is   
not sanitized when using "%00" in conjuction with "%0d%0a"   
within GET-Parameter.  
  
Effect:  
Under certain circumstances it is possible that attackers may   
inject arbitrary script code e. g. to steal authentication data.   
  
Vulnerable Scripts:  
/e107_plugins/content/handlers/content_preset.php  
  
Examples:  
http://[host]/e107_plugins/content/handlers/content_preset.php?  
%3c%00script%0d%0a>alert('reflexted%20XSS')</script>  
  
Possible Solutions:  
Use e107 v1.0.3 (contains updated content_preset.php)  
  
Affected products:  
e107 1.0.2 (older releases have not been tested)  
  
Disclosure Timeline:  
2013/02/18 vendor contacted via email  
2013/02/18 initial response  
2013/03/04 proposed fix by vendor  
2013/03/08 second proposed fix by vendor  
2013/03/13 fix confirmed  
2013/03/14 vendor released update 1.0.3  
2013/04/03 Public disclosure  
  
Credits  
Simon Bieber ([email protected])  
Tele-Consulting security networking training GmbH  
www.tele-consulting.com  
  
Disclaimer:  
All information is provided without warranty. The intent is to   
provide information to secure infrastructure and/or systems, not  
to be able to attack or damage. Therefore Tele-Consulting shall   
not be liable for any direct or indirect damages that might be   
caused by using this information.  
`