TITLE:
VHCS Error Page Cross-Site Scripting and Domain Forward Hijack

SECUNIA ADVISORY ID:
SA17704

VERIFY ADVISORY:
http://secunia.com/advisories/17704/

CRITICAL:
Less critical

IMPACT:
Hijacking, Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
VHCS 2.x
http://secunia.com/product/4489/

DESCRIPTION:
A vulnerability and a security issue have been reported in VHCS,
which can be exploited by malicious users to hijack other users'
domain forwards and by malicious people to conduct cross-site
scripting attacks.

1) Input passed in the URL isn't properly sanitised before being
returned to the user via the "vhcs/gui/errordocs/index.php" error
page. This can be exploited to execute arbitrary HTML and script code
in a user's browser session in context of an affected site.

The vulnerability has been reported in versions 2.2.0 through
2.4.6.2.

2) An unspecified error in the domain alias management when creating
and deleting forwards can be exploited to hijack other users'
forwards.

SOLUTION:
1) Edit the source code to ensure that input is properly sanitised.

2) Apply patch.
http://vhcs.net/new/modules/news/article.php?storyid=17

PROVIDED AND/OR DISCOVERED BY:
1) Moritz Naumann IT Consulting & Services
2) The vendor credits cybekx.

ORIGINAL ADVISORY:
1) http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------