[Full-disclosure] Croogo CMS 1.2 Contact Module Cross Site Scripting Vulnerabilities
Croogo CMS 1.2 Cross Site Scripting Vulnerabilities == Vulnerable Software: 1.2 and prior Release Date: 2010-03-06 Last Update: 2010-02-01 Critical: Low Impact: Session hijack Denial of service Code execution Solution Status:Webvuln has informed and submitted a patch to the vendor Croogo 1.2.1 has been released WebVuln Advisory:1-009 BACKGROUND === Croogo is a content management system gaining popularity rapidily in the CAKEPHP community. Its 'Contact' module allow the users to save the messages and due to lack of input sanitation is vulnerable to cross site scripting attacks. DESCRIPTION === The 'Contact' module allows their users to save the received messages to the database. The vulnerabilities are present because the fields 'title' and 'subject' are not sanitized at all. EXPLOIT / POC === An attacker can exploit this vulnerability simply by sending the malicious code using the fields 'subject' or 'title' located in the contact form. WORKAROUND === Upgrade to Croogo 1.2.1 or download the latest copy of 'contacts_controller.php' from Croogo's public repository DISCLOSURE TIMELINE === 2009/01/15 - Vulnerability discovered 2009/01/20 - Vendor contacted 2009/01/30 - Patch submitted to Croogo's public source code repositories 2010/01/31 - Patch merged with main branch 2009/03/06 - Vulnerability disclosed REFERENCES === Croogo CMS - http://www.croogo.org/ Croogo on GitHub - http://github.com/croogo/croogo WebVuln - http://www.webvuln.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Croogo CMS 1.2.1 Contact Module Cross Site Scripting Vulnerabilities
Croogo CMS 1.2 Cross Site Scripting Vulnerabilities == Vulnerable Software: 1.2 and prior Release Date: 2010-03-06 Last Update: 2010-02-01 Critical: Low Impact: Session hijack Denial of service Code execution Solution Status:Webvuln has informed and submitted a patch to the vendor Croogo 1.2.1 has been released WebVuln Advisory:1-009 BACKGROUND === Croogo is a content management system gaining popularity rapidily in the CAKEPHP community. Its 'Contact' module allow the users to save the messages and due to lack of input sanitation is vulnerable to cross site scripting attacks. DESCRIPTION === The 'Contact' module allows their users to save the received messages to the database. The vulnerabilities are present because the fields 'title' and 'subject' are not sanitized at all. EXPLOIT / POC === An attacker can exploit this vulnerability simply by sending the malicious code using the fields 'subject' or 'title' located in the contact form. WORKAROUND === Upgrade to Croogo 1.2.1 or download the latest copy of 'contacts_controller.php' from Croogo's public repository DISCLOSURE TIMELINE === 2009/01/15 - Vulnerability discovered 2009/01/20 - Vendor contacted 2009/01/30 - Patch submitted to Croogo's public source code repositories 2010/01/31 - Patch merged with main branch 2009/03/06 - Vulnerability disclosed REFERENCES === Croogo CMS - http://www.croogo.org/ Croogo on GitHub - http://github.com/croogo/croogo WebVuln - http://www.webvuln.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] SmartSiteCMS v1.0 authentication bypass
SmartSiteCMS v1.0 authentication bypass
STATUS: I contacted the vendor more than 2 months ago and still no response.
TECHNICAL INFO
One of the worst cms I've ever seen regarding security, no input sanitation
at all. Bypassing authentication just requires to create a cookie named
userName
Vulnerable code:
admin.php line 43
?php
if (isset($_COOKIE['userName']))
{
VULNERABLE VERSIONS
---
Ive only tested v1.0
---
Contact information
:Paulino Calderon
:nahsuckea.com
:http://nah.suckea.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
