exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

CurvyCorners Cross Site Scripting

CurvyCorners Cross Site Scripting
Posted Jan 24, 2013
Authored by Stephan Rickauer | Site csnc.ch

CurvyCorners module versions 6.x-1.x and 7.x-1.x suffer from a cross site scripting vulnerability.

tags | advisory, xss
advisories | CVE-2013-1393
SHA-256 | d7fcabd2dc84c5a5de2f1ab425fd8512a1b54d1044e9469a9dfdc728a0128de3

CurvyCorners Cross Site Scripting

Change Mirror Download
#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2013-1393
# CSNC ID: CSNC-2013-002
# Product: Drupal CurvyCorners
# Vendor: Drupal
# Subject: Cross-site Scripting - XSS
# Risk: High
# Effect: Remotely exploitable
# Author: Stephan Rickauer (stephan.rickauer _at_ csnc.ch)
# Date: January 23rd 2013
#
#############################################################


Introduction:
-------------
Compass Security discovered a web application security flaw in the
CurvyCorners module of the Drupal CMS.


Vulnerable:
-----------
All CurvyCorners 6.x-1.x versions.
All CurvyCorners 7.x-1.x versions.


Not vulnerable:
---------------
unknown


Fix/Patches:
------------
If you use the CurvyCorners module, uninstall the module - there is no
patch available to fix this issue. The module is no longer supported.


Description:
------------
The CurvyCorners module enables you to create rounded corners on HTML
block elements. The module doesn't sufficiently filter user entered
text when being displayed. This vulnerability is mitigated by the fact
that an attacker must have a role with the permission "administer
curvycorners". Exploiting this vulnerability will lead to so-called
cross-site scripting (XSS) and allows the impersonation of logged-in
Drupal users.


Milestones:
-----------
December 14th 2012 Vulnerability discovered
December 14th 2012 Vendor contact established
December 14th 2012 Vendor acknowledged issue
January 17th 2013 CVE ID assigned by MITRE
January 23rd 2013 Public release of advisory by vendor


References:
-----------
XSS reference:
http://en.wikipedia.org/wiki/Cross-site_scripting
Cross-site scripting (XSS) is a type of computer security vulnerability
typically found in web applications which allow code injection by
malicious web users into the web pages viewed by other users. Examples
of such code include HTML code and client-side scripts. An exploited
cross-site scripting vulnerability can be used by attackers to bypass
access controls such as the same origin policy. Recently,
vulnerabilities of this kind have been exploited to craft powerful
phishing attacks and browser exploits.

Drupal SA-CONTRIB-2013-008:
http://drupal.org/node/1896718


Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close