[ONSEC-09-020] Mura CMS root folder disclosure Objective: Mura CMS <= 5.1 Type: Disclosure of ways Threat: Medium Date Discovered: 22.09.2009 Date of notification Developer: 22.09.2009 Released corrections: Author: Vladimir Vorontsov OnSec Russian Security Group (onsec [dot] ru) Description: content management system Mura CMS found a number of information disclosure vulnerability. An attacker can learn the version and type of database driver, database name, structure and format of some DBMS tables, column names, their type and size information about the Web server and virtual machine, Java. The vulnerability exists due to the error message when you try to write in the database values is not suitable for the format. Implementation: http://localhost:8888/go/default/blog/blog-post-with-flash-video/ # comments Enter the "Name" value is greater than 50 characters and submit the form. ============================================================================ [ONSEC-09-019] Mura CMS XSS Objective: Mura CMS <= 5.1 Type: Cross-site scripting Threat: Medium Date Discovered: 22.09.2009 Date of notification Developer: 22.09.2009 Released corrections: Author: Vladimir Vorontsov OnSec Russian Security Group (onsec [dot] ru) Description: In the western system of site management Mura CMS found a number of cross-site scripting vulnerabilities reflected and stored type. Implementation: 1. There is no filtering in the parameter link. Thus, it is possible to attack the reflected type. http://localhost:8888/default/includes/display_objects/sendtofriend/index.cfm?link =% 22% 3E% 3Cscript% 3Ealert ( "ONsec.ru% 20russian% 20security% 20team");% 3C/script% 3E % 3Cdiv & siteid = default 2. No filtering parameter returnURL available on many pages, including: http://localhost:8888/go/default/blog/?display=editProfile&nocache=1&returnURL =% 22% 3E% 3Cscript% 3Ealert ( "ONsec.ru% 20Russian% 20security% 20research% 20team% 5Cn% 5Cn"% 2Bdocument. cookie);% 3C/script% 3E 3. Stored vulnerability detected by adding entries to blog On http://localhost:8888/go/default/blog/blog-post-with-flash-video/?nocache=1 enter a value like this ">