Home page logo

fulldisclosure logo Full Disclosure mailing list archives

IAA and XSS vulnerabilities in CMS WebManager-Pro
From: "MustLive" <mustlive () websecurity com ua>
Date: Sat, 12 Mar 2011 23:28:12 +0200

Hello list!

I want to warn you about Insufficient Anti-automation and Cross-Site
Scripting vulnerabilities in CMS WebManager-Pro.

It's Ukrainian commercial CMS. Earlier I already told about interesting RCE
vulnerability in this CMS, which I mentioned about last month in article 
Placing shells (backdoors) at web sites

Affected products:

Vulnerable are CMS WebManager-Pro v.7.4.3 (version from FGS_Studio) and
previous versions.


Insufficient Anti-automation (WASC-21):

At contact page (http://site/index.php?menu_id=x) there is no protection
against automated requests (captcha).

XSS (WASC-08):

POST request at contact page (http://site/index.php?menu_id=x)

In fields: Name, E-mail, Phone, Subject, Text.


2011.01.11 - announced at my site.
2011.01.12 - informed developers.
2011.03.11 - disclosed at my site.

I mentioned about these vulnerabilities at my site

Best wishes & regards,
Administrator of Websecurity web site

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • IAA and XSS vulnerabilities in CMS WebManager-Pro MustLive (Mar 12)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]