Croogo CMS 1.2 Cross Site Scripting

`Croogo CMS 1.2 Cross Site Scripting Vulnerabilities  
==========================================  
  
Vulnerable Software: 1.2 and prior  
Release Date: 2010-03-06  
Last Update: 2010-02-01  
Critical: Low  
Impact: Session hijack  
Denial of service  
Code execution  
  
Solution Status: Webvuln has informed and submitted a patch to the vendor  
Croogo 1.2.1 has been released  
WebVuln Advisory: 1-009  
  
  
BACKGROUND  
=======================  
  
Croogo is a content management system gaining popularity rapidily in the  
CAKEPHP community. Its 'Contact' module allow the users to save the  
messages and due to lack of input sanitation is vulnerable to cross site  
scripting attacks.  
  
  
DESCRIPTION  
=======================  
  
The 'Contact' module allows their users to save the received messages to  
the database. The vulnerabilities are present because the fields 'title'  
and  
'subject' are not sanitized at all.  
  
  
  
EXPLOIT / POC  
=======================  
  
An attacker can exploit this vulnerability simply by sending the  
malicious code using the fields 'subject' or 'title' located in the  
contact form.  
  
WORKAROUND  
=======================  
  
Upgrade to Croogo 1.2.1 or download the latest copy of  
'contacts_controller.php' from Croogo's public repository  
  
  
DISCLOSURE TIMELINE  
=======================  
  
2009/01/15 - Vulnerability discovered  
2009/01/20 - Vendor contacted  
2009/01/30 - Patch submitted to Croogo's public source code repositories  
2010/01/31 - Patch merged with main branch  
2009/03/06 - Vulnerability disclosed  
  
  
REFERENCES  
=======================  
Croogo CMS - http://www.croogo.org/  
Croogo on GitHub - http://github.com/croogo/croogo  
WebVuln - http://www.webvuln.com  
  
`