0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
openEngine 2.0 100226 LFI and XSS Vulnerabilities
[=================================================
openEngine 2.0 100226 LFI and XSS Vulnerabilities
=================================================
##############################################################################
SecPod Technologies (www.secpod.com)
Title : openEngine Local File Inclusion and XSS Vulnerabilities
Vendor : http://www.openengine.de
Advisory : http://secpod.org/blog/?p=152
http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt
Version : openEngine 2.0 100226; other versions may also be affected.
Download : http://www.openengine.de/download/openengine20_100226.zip
Date : 11/16/2010
###############################################################################
SecPod ID: 1009 10/20/2010 Issue Discovered
Class: Local File Inclusion and XSS Severity: High
Overview:
---------
openEngine is prone to local file inclusion and XSS vulnerabilities.
Technical Description:
----------------------
openEngine is prone to a local file inclusion and XSS vulnerabilities. The
application fails to properly sanitize user-supplied input.
Input passed via the 'template' parameter in "cms/website.php" is not properly
verified before it is returned to the user. This can be exploited to obtain
potentially sensitive information and execute arbitrary HTML, script code
in an users browser session in the context of an affected site.
The exploit has been tested on openEngine 2.0 100226
Impact:
--------
Successful exploitation allows an attacker to obtain potentially sensitive
information and execute arbitrary arbitrary HTML, script code in the context
of an affected site.
Affected Software:
------------------
openEngine 2.0 100226; other versions may also be affected.
References:
-----------
http://www.openengine.de
http://secpod.org/blog/?p=152
http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt
Proof of Concepts:
------------------
* local file inclusion,
http://localhost/cms/website.php?template=../../../../../../../../etc/passwd%00
* XSS,
http://localhost/cms/website.php?template=<script>alert(document.cookie)</script>
Workaround:
-----------
Not available
Solution:
----------
Not available
Risk Factor:
-------------
CVSS Score Report:
ACCESS_VECTOR = NETWORK
ACCESS_COMPLEXITY = MEDIUM
AUTHENTICATION = NOT_REQUIRED
CONFIDENTIALITY_IMPACT = PARTIAL
INTEGRITY_IMPACT = PARTIAL
AVAILABILITY_IMPACT = PARTIAL
EXPLOITABILITY = PROOF_OF_CONCEPT
REMEDIATION_LEVEL = UNAVAILABLE
REPORT_CONFIDENCE = CONFIRMED
CVSS Base Score = 6.8 (AV:N/AC:M/Au:NR/C:P/I:P/A:P)
CVSS Temporal Score = 6.1
Risk factor = High
# 0day.today [2024-07-02] #