CMSimple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	42470
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2010 12:00AM
Updated:	Aug 16 2010 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:	Peter Andreas Harteg CMSimple 3.3
Not Vulnerable:

CMSimple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

CMSimple is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability.

An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions. Other attacks are also possible.

CMSimple 3.3 is vulnerable; other versions may also be affected.

CMSimple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Attackers can exploit these issues through a browser.

The following example requests are available:

• /data/vulnerabilities/exploits/42470.txt

CMSimple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CMSimple Cross Site Scripting and Cross Site Request Forgery Vulnerabilities

References:

• CMSimple Home Page (CMSimple)
  
• XSRF (CSRF) in CMSimple ([email protected])
  
• XSS vulnerability in CMSimple ([email protected])
  
• XSS vulnerability in CMSimple ([email protected])
  
• XSS vulnerability in CMSimple ([email protected])