Pecio CMS 2.0.5 Cross Site Scripting

`###############################################################################  
Pecio Content Management System (CMS) v2.0.5 Cross-Site scripting Vulnerability  
  
SecPod Technologies (www.secpod.com)  
Author: Antu Sanadi  
###############################################################################  
  
SecPod ID: 1006 09/10/2010 Issue Discovered  
09/21/2010 Vendor Notified  
09/21/2010 Vendor Confirmed  
Solution not available.  
  
  
Class: Cross-Site Scripting Severity: Medium  
  
  
Overview:  
---------  
Pecio Content Management System (CMS) is prone to cross-site scripting  
vulnerability.  
  
Technical Description:  
----------------------  
Pecio Content Management System (CMS) is prone to a cross-site scripting  
vulnerability as it fails to properly sanitize user-supplied input.  
  
Input passed via the 'target' parameter in 'search' action in index.php is  
not properly verified before it is returned to the user. This can be exploited  
to execute arbitrary HTML and script code in a user's browser session in the  
context of a vulnerable site. This may allow an attacker to steal cookie-based  
authentications and launch further attacks.  
  
The vulnerability has been tested in Pecio CMS v2.0.5 and 2.0.2 Other versions  
may also be affected.  
  
  
Impact:  
--------  
Successful exploitation could allow an attacker to execute arbitrary HTML  
code in a user's browser session in the context of a vulnerable application.  
  
  
Affected Software:  
------------------  
Pecio CMS v2.0.5 and prior.  
  
Tested on,  
Pecio CMS v2.0.5 and 2.0.2(tested using Mozilla firefox browser)  
  
  
References:  
-----------  
http://pecio-cms.com/  
http://secpod.org/blog/?p=137  
http://secpod.org/advisories/SECPOD_pecioCMS_XSS.txt  
  
Proof of Concept:  
-----------------  
http://IP_ADDR/pecio/index.php?target=search&term=<script>alert('XSS-Test')</script>  
  
  
Solution:  
----------  
Fix not available  
  
  
Risk Factor:  
-------------  
CVSS Score Report  
ACCESS_VECTOR = NETWORK  
ACCESS_COMPLEXITY = MEDIUM  
AUTHENTICATION = NONE  
CONFIDENTIALITY_IMPACT = NONE  
INTEGRITY_IMPACT = PARTIAL  
AVAILABILITY_IMPACT = NONE  
EXPLOITABILITY = PROOF_OF_CONCEPT  
REMEDIATION_LEVEL = UNAVAILABLE  
REPORT_CONFIDENCE = CONFIRMED  
CVSS Base Score = 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N)  
  
  
Credits:  
--------  
Antu Sanadi of SecPod Technologies has been credited with the discovery of this  
vulnerability.  
  
`