Title: RunCMS XSS Vulnerability via User Agent Vendor: RunCMS Product: RunCMS Tested Version: 2.1 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http request to a script within the forum module. ----- modules/forum/check.php ----- 01: ... 10: echo "BROWSER: ".$_SERVER['HTTP_USER_AGENT']; ----- modules/forum/check.php ----- ===== Impact ===== Malicious java script code can be executed in the context of the affected web site. ===== Proof of Concept ===== wget --user-agent=" " http://target/modules/forum/check.php ===== Workaround ===== Remove the affected file form the system: modules/forum/check.php. ===== Disclosure Timeline ===== June, 16 2010 - Vendor notification. June, 17 2010 - Vendor response confirming the bug. July, 07 2010 - Public disclosure. ===== References ===== http://www.runcms.org _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969
