Mura CMS Multiple Cross Site Scripting Vulnerabilities
BID:45384
Info
Mura CMS Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 45384 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 13 2010 12:00AM |
| Updated: | Dec 13 2010 12:00AM |
| Credit: | Richard Brain of ProCheckUp Ltd |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Mura CMS Multiple Cross Site Scripting Vulnerabilities
Mura CMS is prone to multiple cross-site-scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials; other attacks are also possible.
Mura CMS 5.2.2085 is vulnerable; other versions may also be affected.
Mura CMS is prone to multiple cross-site-scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials; other attacks are also possible.
Mura CMS 5.2.2085 is vulnerable; other versions may also be affected.
Exploit / POC
Mura CMS Multiple Cross Site Scripting Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URIs are available:
Solution / Fix
Mura CMS Multiple Cross Site Scripting Vulnerabilities
Solution:
The reporter indicates that patches are available; this has not been confirmed. Users are advised to contact the vendor for more information.
Solution:
The reporter indicates that patches are available; this has not been confirmed. Users are advised to contact the vendor for more information.
References
Mura CMS Multiple Cross Site Scripting Vulnerabilities
References:
References:
- Mura Home Page (Blue River Interactive Group)
- ProCheckUp Research: PR10-09 Multiple XSS and Cross Domain redirect within Mura (ProCheckUp Research)