Exponent CMS Multiple Input Validation Vulnerabilities
BID:44095
Info
Exponent CMS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 44095 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 13 2010 12:00AM |
| Updated: | Dec 08 2010 05:45PM |
| Credit: | LiquidWorm |
| Vulnerable: |
Exponent CMS Exponent CMS 2.0.0.pr2 Exponent CMS Exponent CMS 0.97 |
| Not Vulnerable: | |
Discussion
Exponent CMS Multiple Input Validation Vulnerabilities
Exponent CMS is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include local file-include, information-disclosure, arbitrary-file-upload, arbitrary-file-modify, and cross-site-scripting vulnerabilities.
Exploiting these issues can allow an attacker to steal cookie-based authentication credentials, view and execute local files within the context of the webserver, upload arbitrary code and run it in the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Exponent CMS 0.97 is vulnerable; other versions may also be affected.
Exponent CMS is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include local file-include, information-disclosure, arbitrary-file-upload, arbitrary-file-modify, and cross-site-scripting vulnerabilities.
Exploiting these issues can allow an attacker to steal cookie-based authentication credentials, view and execute local files within the context of the webserver, upload arbitrary code and run it in the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
Exponent CMS 0.97 is vulnerable; other versions may also be affected.
Exploit / POC
Exponent CMS Multiple Input Validation Vulnerabilities
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
http://www.example.com/index.php?action=[LFI]
http://www.example.com/modules/cermi/actions/upload_fileuploadcontrol.php?action=[FILE]&expid=[FILE]&ajax_action=[FILE]
http://www.example.com/external/magpierss/scripts/magpie_slashbox.php?rss_url=3141%3cscript%3ealert("zsl_xss")%3c%2fscript%3e
An attacker can exploit these issues via a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into visiting a malicious URI.
The following example URIs are available:
http://www.example.com/index.php?action=[LFI]
http://www.example.com/modules/cermi/actions/upload_fileuploadcontrol.php?action=[FILE]&expid=[FILE]&ajax_action=[FILE]
http://www.example.com/external/magpierss/scripts/magpie_slashbox.php?rss_url=3141%3cscript%3ealert("zsl_xss")%3c%2fscript%3e
Solution / Fix
Exponent CMS Multiple Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Exponent CMS Multiple Input Validation Vulnerabilities
References:
References:
- Homepage (ExponentCMS)
- HTB22717- LFI in Exponent CMS (High-Tech Bridge SA)
- HTB22718- LFI in Exponent CMS (High-Tech Bridge SA)
- LFI in Exponent CMS ([email protected])
- LFI in Exponent CMS ([email protected])