[Full-disclosure] Silverstripe <= v2.3.4: two XSS vulnerabilities

From: Moritz Naumann <security_at_nospam>
Date: Fri Jan 22 2010 - 19:04:01 GMT
To: Full Disclosure <full-disclosure@lists.grok.org.uk>, bugtraq@securityfocus.com

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512

Silverstripe CMS, <http://silverstripe.org/>, version 2.3.4 and lower (and its unreleased 2.4 branch), is vulnerable to two Cross Site Scripting issues.

The comment posting mechanism of Silverstripe ('PostCommentForm') fails to properly sanitize the 'CommenterURL' parameter. This allows for persistent injection of HTML or javascript code within existing HTML tags.
The forum module is vulnerable to a reflective XSS issue caused by the search script failing to properly sanitize input to the 'Search' parameter. When invoking this URL: SILVERSTRIPESITE/forums/search/?Search=%22%20onmouseover=%22javascript:alert%280%29;%22 trying to reorder the search results will trigger execution of the injected javascript code.

According to its quickly responding developers, Silverstripe version 2.3.5 fixes both issues:
http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456

Relevant SCM changesets: http://open.silverstripe.org/changeset/97034 http://open.silverstripe.org/changeset/97070 http://open.silverstripe.org/changeset/97073 http://open.silverstripe.org/changeset/97074
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.10 (GNU/Linux)

iEYEAREKAAYFAktZ9qEACgkQn6GkvSd/BgzVmACfaNiygTiaMy59QygEu0xeZ93S KzsAoIIQA7krAVdNycjXdh7EaIMUiVk+
=9I4y
-----END PGP SIGNATURE-----

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

This message: [ Message body ]
Next message: exploit dev: "Re: [Full-disclosure] CVE-2010-0249 in the wild"
Previous message: Jamie Strandboge: "[USN-890-3] Python 2.4 vulnerabilities"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]