TUCoPS :: Web :: CMS / Portals :: b1a-1420.htm

MODx Installation File XSS Vulnerability
MODx Installation File XSS Vulnerability
MODx Installation File XSS Vulnerability

Title: MODx Installation File XSS Vulnerability
Vendor: MODx
Product: MODx CMF
Tested Versions: 1.0.3=2C 1.0.4
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares

===== Description ====
MODx CMF is prone to a XSS vulnerability caused by unsanitized user input data. The bug occurs in a file used in the installation process. A description of the affected file is shown below:

--- install/connection.collation.php ----
01: ...
06: $database_collation = $_POST['database_collation']=3B
08: $output = '09: '.$database_collation.''=3B
23: echo $output=3B
24: ?>
--- install/connection.collation.php ----

The variable $database_collation (line 6) receives user data via http post request and gets propagated to variable $output (line 9) without proper sanitization. Later the $output variable is outputted to the page in every program path causing the bug (line 23).

===== Impact ====
Malicious java script code can be executed in the context of the affected web site.

===== Proof of Concept ====

===== Workaround ====
Remove all installation files after MODx is successfully installed.

===== Disclosure Timeline ====
June=2C 16 2010 - Vendor notification.
July=2C 07 2010 - No vendor reply. Public disclosure.

===== References ====
Hotmail: Trusted email with powerful SPAM protection.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986- AOH