Kentico CMS 7.0.75 User Enumeration

`# Exploit Title: Kentico CMS User Enumeration Bug  
# Google Dork: inurl:/CMSPages/logon.aspx <-- enumerates several Kentico  
CMS sites  
# Date: 02-25-2014  
# Exploit Author: Charlie Campbell and Lyndon Mendoza  
# Vendor Homepage: http://www.kentico.com/  
# Software Link: http://www.kentico.com/Download-Demo/Trial-Version  
# Version: [Version 7.0.75 and previous versions]  
  
This vulnerability is an unprotected page on the site where you can view  
all current users and usernames.  
To find out if a Kentico CMS is vulnerable go to  
  
http://site.com/CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx  
  
assuming that the Kentico CMS was installed to the root folder in the  
server.  
  
I have already notified the authors and security team for Kentico CMS, in  
their response they claimed they would issue a patch on 02-21-2014.  
  
  
`