Lucene search
wmscms-xss.txt
🗓️ 10 Jun 2007 00:00:00Reported by Glafkos CharalambousType 
packetstorm🔗 packetstormsecurity.com👁 30 Views
WmsCMS web-based CMS Remote Cross-Site Scripting Vulnerability, Severity: Less Critical, Unpatched Solution
Show more
`Application: WmsCMS
Vendors Url: http://www.web-master.biz
Bug Type: Multiple URL Handling Remote Cross-Site Scripting Vulnerabilities
Exploitation: Remote
Severity: Less Critical
Solution Status: Unpatched
Introduction: WmsCMS is a web-based CMS system
Google Dork: "Powered by WMS-CMS"
Affected Versions WmsCMS <= 2.0
Description:
User-supplied input passed via the URL is not properly sanitised before it is being returned to the user in index.php?pageid=. This can be exploited to execute arbitrary script code in the security context of an affected website, as a result the code will be able to access any of the target user's cookies, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
PoC:
http://[target]/4print.asp?p=60&sbl=>">[XSS]
http://[target]/4print.asp?p=60&sbr=>">[XSS]
<html>
<body>
<center>
<form action="http://[target]/default.asp?p=60&sbl=20&sbr=1" method="post">
<input value="[XSS]" name="search" />
<input type="submit" value="search">
</form>
</center>
</body>
</html>
Solution:
There was no vendor-supplied solution at the time of entry.
Edit source code manually to ensure user-supplied input is correctly sanitised.
Filter malicious characters and character sequences via a HTTP proxy or firewall with URL filtering capabilities.
Credits:
Glafkos Charalambous
glafkos (at) infosec (dot) org (dot) uk
Information Security Uncensored
InfoSEC.org.uk
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo10 Jun 2007 00:00Current
7.4High risk
Vulners AI Score7.4