Title: MODx Installation File XSS Vulnerability Vendor: MODx Product: MODx CMF Tested Versions: 1.0.3, 1.0.4 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares
===== Description =====
MODx CMF is prone to a XSS vulnerability caused by unsanitized user input data. The bug occurs in a file used in the installation process. A description of the affected file is shown below:
--- install/connection.collation.php ---- 01: ... 06: $database_collation = $_POST['database_collation']; ... 08: $output = '09: '.$database_collation.''; ... 23: echo $output; 24: ?> --- install/connection.collation.php ----
The variable $database_collation (line 6) receives user data via http post request and gets propagated to variable $output (line 9) without proper sanitization. Later the $output variable is outputted to the page in every program path causing the bug (line 23).
===== Impact =====
Malicious java script code can be executed in the context of the affected web site.
===== Proof of Concept =====
===== Workaround =====
Remove all installation files after MODx is successfully installed.
===== Disclosure Timeline =====
June, 16 2010 - Vendor notification. July, 07 2010 - No vendor reply. Public disclosure.
===== References =====
Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969