Rainbow CMS Multiple Input Validation Vulnerabilities
BID:42934
Info
Rainbow CMS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 42934 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 02 2010 12:00AM |
| Updated: | Sep 02 2010 12:00AM |
| Credit: | Abysssec |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Rainbow CMS Multiple Input Validation Vulnerabilities
Rainbow CMS is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include an SQL-injection issues, multiple HTML-injection issues, and multiple cross-site scripting issue.
Exploiting these issues can allow an attacker to run malicious HTML and script code in the context of the affected browser, steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Rainbow CMS version 2.0.0.1881e and 2.0 are vulnerable; other versions may be affected.
Rainbow CMS is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include an SQL-injection issues, multiple HTML-injection issues, and multiple cross-site scripting issue.
Exploiting these issues can allow an attacker to run malicious HTML and script code in the context of the affected browser, steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Rainbow CMS version 2.0.0.1881e and 2.0 are vulnerable; other versions may be affected.
Exploit / POC
Rainbow CMS Multiple Input Validation Vulnerabilities
An attacker can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
HTML- injection:
http://www.example.com/DesktopModules/MileStones/MilestonesEdit.aspx?tabID=0&ItemID=1&Mid=2833
http://www.example.com/DesktopModules/Contacts/ContactsEdit.aspx?tabID=181&ItemID=1&mid=2837
http://www.example.com/DesktopModules/Blog/BlogView.aspx?tabID=181&ItemID=1&mid=2824
http://www.example.com/DesktopModules/Announcements/AnnouncementsEdit.aspx?tabID=181&mID=2823
http://www.example.com/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx?tabID=181&mID=2820
http://www.example.com/DesktopModules/Documents/DocumentsEdit.aspx?tabID=0&ItemID=1&mid=2841
Cross-site scripting:
http://www.example.com/app_support/FCK.filemanager/imagegallery.aspx?1&">[XSS]
http://www.example.com/aspnet_client/ELB/ELB_arrowButton.aspx?ctlID=0&chunkSize=200000000000002&hashCode=20&filterValue=[XSS]&filterType=20
An attacker can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
HTML- injection:
http://www.example.com/DesktopModules/MileStones/MilestonesEdit.aspx?tabID=0&ItemID=1&Mid=2833
http://www.example.com/DesktopModules/Contacts/ContactsEdit.aspx?tabID=181&ItemID=1&mid=2837
http://www.example.com/DesktopModules/Blog/BlogView.aspx?tabID=181&ItemID=1&mid=2824
http://www.example.com/DesktopModules/Announcements/AnnouncementsEdit.aspx?tabID=181&mID=2823
http://www.example.com/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx?tabID=181&mID=2820
http://www.example.com/DesktopModules/Documents/DocumentsEdit.aspx?tabID=0&ItemID=1&mid=2841
Cross-site scripting:
http://www.example.com/app_support/FCK.filemanager/imagegallery.aspx?1&">[XSS]
http://www.example.com/aspnet_client/ELB/ELB_arrowButton.aspx?ctlID=0&chunkSize=200000000000002&hashCode=20&filterValue=[XSS]&filterType=20
Solution / Fix
Rainbow CMS Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].