TUCoPS :: Web :: CMS / Portals :: b1a-1423.htm

RunCMS XSS Vulnerability via User Agent
RunCMS XSS Vulnerability via User Agent
RunCMS XSS Vulnerability via User Agent




Title: RunCMS XSS Vulnerability via User Agent
Vendor: RunCMS
Product: RunCMS
Tested Version: 2.1
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares

===== Description ====
RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http request to a script within the forum module.

----- modules/forum/check.php -----
01: ...
10: echo "BROWSER: ".$_SERVER['HTTP_USER_AGENT']=3B
----- modules/forum/check.php -----

===== Impact ====
Malicious java script code can be executed in the context of the affected web site.

===== Proof of Concept ====
wget --user-agent="

" http://target/modules/forum/check.php 

===== Workaround ====
Remove the affected file form the system: modules/forum/check.php.

===== Disclosure Timeline ====
June=2C 16 2010 - Vendor notification.
June=2C 17 2010 - Vendor response confirming the bug.
July=2C 07 2010 - Public disclosure.

===== References ====
http://www.runcms.org 
_________________________________________________________________
Hotmail: Free=2C trusted and rich email service.
https://signup.live.com/signup.aspx?id=60969

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH