Bitrix Site Manager Multiple Input Validation Vulnerabilities
BID:33689
Info
Bitrix Site Manager Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 33689 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 09 2009 12:00AM |
| Updated: | Feb 17 2009 06:48PM |
| Credit: | aGGreSSor |
| Vulnerable: |
Bitrix Site Manager Site Manager 7 Bitrix Site Manager Site Manager 6 |
| Not Vulnerable: | |
Discussion
Bitrix Site Manager Multiple Input Validation Vulnerabilities
Bitrix Site Manager is prone to multiple input-validation vulnerabilities:
- An authentication-bypass vulnerability
- A cross-site scripting vulnerability
An attacker may leverage these issues to gain unauthorized access to the affected application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, and steal cookie-based authentication credentials. Other attacks are also possible.
Bitrix Site Manager is prone to multiple input-validation vulnerabilities:
- An authentication-bypass vulnerability
- A cross-site scripting vulnerability
An attacker may leverage these issues to gain unauthorized access to the affected application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, and steal cookie-based authentication credentials. Other attacks are also possible.
Exploit / POC
Bitrix Site Manager Multiple Input Validation Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI and sample data are available:
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI and sample data are available:
Solution / Fix
Bitrix Site Manager Multiple Input Validation Vulnerabilities
Solution:
The vendor has released updates through the internal 'SiteUpdate' system. Please contact the vendor for details.
Solution:
The vendor has released updates through the internal 'SiteUpdate' system. Please contact the vendor for details.
References
Bitrix Site Manager Multiple Input Validation Vulnerabilities
References:
References:
- Bitrix Site Manager Home Page (Bitrix)