Micro CMS 1.0 b1 Cross Site Scripting

`##############################################################################  
  
Title : Micro CMS Persistent Cross-Site Scripting Vulnerability.  
Author : Veerendra G.G from SecPod Technologies (www.secpod.com)  
Vendor : http://www.micro-cms.com/  
Advisory : http://secpod.org/blog/?p=135  
http://secpod.org/advisories/SECPOD_MicroCMS.txt  
Version : Micro CMS 1.0 beta 1  
Date : 09/28/2010  
  
###############################################################################  
  
SecPod ID: 1004 09/03/2010 Issue Discovered  
09/05/2010 Vendor Notified  
No Response from Vendor  
  
  
Class: Persistent Cross-Site Scripting Severity: High  
  
  
Overview:  
---------  
Micro CMS is prone to Persistent Cross-Site Scripting Vulnerability.  
  
Technical Description:  
----------------------  
Micro CMS is prone to a Persistent Cross-Site vulnerability because it fails to  
properly sanitize user-supplied input.  
  
Input passed via the 'name' parameter(also in text-area) in a comment section  
to "comments/send/" is not properly verified before it is returned to the  
user. This can be exploited to execute arbitrary HTML and script code in a  
user's browser session in the context of a vulnerable site. This may allow  
the attacker to steal cookie-based authentication and to launch further attacks.  
  
The exploit has been tested in Micro CMS 1.0 beta 1  
  
  
Impact:  
--------  
Successful exploitation allows an attacker to execute arbitrary HTML and script  
code in a user's browser session in the context of a vulnerable site.  
  
  
Affected Software:  
------------------  
Micro CMS 1.0 beta 1 and prior  
  
  
References:  
-----------  
http://www.micro-cms.com/  
http://secpod.org/blog/?p=135  
http://secpod.org/advisories/SECPOD_MicroCMS.txt  
  
  
Proof of Concepts:  
------------------  
Add the following attack strings:  
1. My XSS Test </legend><script> alert('XSS-Test')</script> <!--  
  
OR  
  
2. My XSS Test </legend><script> alert('XSS-Test')</script>  
  
OR  
  
3. <script> alert('XSS-Test')</script>  
  
in "* Name" textbox in comment section and fill other sections properly.  
  
NOTE : Some time above POC/Exploit will disable adding comments for that post.  
  
  
Workaround:  
-----------  
Not available  
  
  
Solution:  
----------  
Not available  
  
  
Risk Factor:  
-------------  
CVSS Score Report:  
ACCESS_VECTOR = NETWORK  
ACCESS_COMPLEXITY = MEDIUM  
AUTHENTICATION = NOT_REQUIRED  
CONFIDENTIALITY_IMPACT = NONE  
INTEGRITY_IMPACT = PARTIAL  
AVAILABILITY_IMPACT = PARTIAL  
EXPLOITABILITY = PROOF_OF_CONCEPT  
REMEDIATION_LEVEL = UNAVAILABLE  
REPORT_CONFIDENCE = CONFIRMED  
CVSS Base Score = 5.8 (AV:N/AC:M/Au:NR/C:N/I:P/A:P)  
CVSS Temporal Score = 5.2  
Risk factor = High  
  
Credits:  
--------  
Veerendra G.G of SecPod Technologies has been credited with the discovery of  
this vulnerability.  
  
`