gpEasy CMS 'section' Parameter Cross Site Scripting Vulnerability

Bugtraq ID:	57522
Class:	Input Validation Error
CVE:	CVE-2013-0807
Remote:	Yes
Local:	No
Published:	Jan 23 2013 12:00AM
Updated:	Jan 23 2013 12:00AM
Credit:	High-Tech Bridge SA
Vulnerable:
Not Vulnerable:

gpEasy CMS 'section' Parameter Cross Site Scripting Vulnerability

gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

gpEasy CMS 3.5.2 and prior versions are vulnerable.

gpEasy CMS 'section' Parameter Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

The following example URI is available:

http://www.example.com//?cmd=new_section&section=%22%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

gpEasy CMS 'section' Parameter Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

gpEasy CMS 'section' Parameter Cross Site Scripting Vulnerability

References:

• gpEasy Homepage (gpEasy)
  
• new_section vulnerability fixed (gpEasy-CMS)
  
• CVE-2013-0807: Cross-Site Scripting (XSS) vulnerability in gpEasy (High-Tech Bridge)