CommonSense CMS Search.PHP Cross-site Scripting Vulnerability

Bugtraq ID:	18880
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 07 2006 12:00AM
Updated:	Dec 30 2009 08:42PM
Credit:	LBDT is credited with discovering this vulnerability.
Vulnerable:	SenseSites CommonSense CMS 5.0
Not Vulnerable:

CommonSense CMS Search.PHP Cross-site Scripting Vulnerability

CommonSense CMS is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CommonSense CMS Search.PHP Cross-site Scripting Vulnerability

Attackers can exploit this issue by enticing a user into following a malicious link.

The following example URI is available:

• /data/vulnerabilities/exploits/commonsense-jul-7-2006.txt

CommonSense CMS Search.PHP Cross-site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please email us at: [email protected].

CommonSense CMS Search.PHP Cross-site Scripting Vulnerability

References:

• CommonSense CMS Homepage (SenseSites)
  
• FreeWebshop - Cross Site Scripting & SQL Injection Vulnerabilities (NewAngels Staff)