Document Title: =============== Fuzzylime v3.03b CMS - CS Cross Scripting Vulnerability References (Source): ==================== http://vulnerability-lab.com/get_content.php?id=1357 Release Date: ============= 2014-12-02 Vulnerability Laboratory ID (VL-ID): ==================================== 1357 Common Vulnerability Scoring System: ==================================== 2.4 Product & Service Introduction: =============================== Fuzzylime (cms) is the easiest way for you to run your site and keep it up-to-date. Once installed, you can update from any internet-connected PC in the world – you don`t even need to know HTML! It has tons of features so whatever you want from your site, chances are this script will be able to do it for you. (Copy of the Homepage: http://www.fuzzylime.co.uk/ ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered a client-side cross site scripting vulnerability in the official Fuzzylime v3.03b CMS. Vulnerability Disclosure Timeline: ================================== 2014-12-02: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== FuzzyLime Limited Product: Fuzzylime - Content Management System 3.03b Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A client-side cross site scripting web vulnerability has been discovered in the official Fuzzylime v3.03b Content Management System. The non-persistent web vulnerability allows to manipulate client-side application requests to compromise user session information. The vulnerability is located in the mailing.php file. Remote attackers are able to inject client-side script codes by usage of the GET method request with the vulnerable list value. The encoding of the list value in the mailing.php file is broken. The attack vector is non-persistent and the request method to inject is GET. The security risk of the client-side vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 2.4. Exploitation of the non-persistent cross site vulnerability requires no privileged web-application user account and low user interaction. Successful exploitation of the vulnerabilities result in client-side phishing, client-side session hijacking attacks, client-side external redirect to malicious sources and client-side manipulation of affected or connected module context. Request Method(s): [+] GET Vulnerable Module(s): [+] Mailinglist Vulnerable File(s): [+] mailing.php Vulnerable Parameter(s): [+] list Proof of Concept (PoC): ======================= The client-side cross site scripting vulnerability can be exploited by remote attackers without privileged application user account and low user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue. Google Dork(s): allinurl:powered by fuzzylime (cms) title:powered by fuzzylime (cms) PoC: Mailing.php http://fuzzylime.127.0.0.1:8080/fuzzylime/admin/mailing.php?list="><[CROSS SITE SCRIPTING VULNERABILITY!]> Exploit: Client-Side Cross Site Scripting Vulnerability PoC: Client-Side Cross Site Scripting Vulnerability alert(document.cookie)
<[CROSS SITE SCRIPTING VULNERABILITY!]>'

Enter addresses in the box below - one per line.

form method="post" action="mailing.php?list="><[CROSS SITE SCRIPTING VULNERABILITY!]>'&opt=add_x">