CompactCMS Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	44949
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 18 2010 12:00AM
Updated:	Nov 18 2010 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:	CompactCMS CompactCMS 1.4.1
Not Vulnerable:	CompactCMS CompactCMS 1.4.2

CompactCMS Multiple Cross Site Scripting Vulnerabilities

CompactCMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

CompactCMS 1.4.1 is vulnerable; other versions may also be affected.

CompactCMS Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

The following example URI and input are available:

• /data/vulnerabilities/exploits/44949.txt

CompactCMS Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released an update. Please see the references for more information.

CompactCMS Multiple Cross Site Scripting Vulnerabilities

References:

• CompactCMS Homepage (CompactCMS)
  
• HTB22695 - XSS in CompactCMS (High-Tech Bridge)
  
• HTB22696 - XSS in CompactCMS (High-Tech Bridge)
  
• XSS in CompactCMS ([email protected])