Limny 3.0.1 (login.php) Remote URI Based Cross-Site Scripting Vulnerability
Title: Limny 3.0.1 (login.php) Remote URI Based Cross-Site Scripting Vulnerability
Advisory ID: ZSL-2012-5066
Type: Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 04.01.2012
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Apache 2.2.21
MySQL 5.5.16
PHP 5.3.8
[06.01.2012] Vendor releases version 3.0.2 to address this issue.
[2] http://www.securityfocus.com/bid/51261
[3] http://cxsecurity.com/issue/WLB-2012010034
[4] http://secunia.com/advisories/47444/
[5] http://xforce.iss.net/xforce/xfdb/72113
[6] http://osvdb.org/show/osvdb/78093
[7] http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5343
[8] http://www.securiteam.com/securitynews/6Y02Y0K60E.html
[9] http://www.securiteam.com/securitynews/6L02V0A60A.html
[05.01.2012] - Added reference [1], [2], [3] and [4]
[06.01.2012] - Added vendor status and reference [5] and [6]
[24.11.2012] - Added reference [7]
[29.11.2012] - Added reference [8] and [9]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2012-5066
Type: Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 04.01.2012
Summary
Limny is a free and open-source content management framework with a focus on ease to use and develop. It can be used as a stable and powerful core for heavy and light web applications by having main features of web applications such as user management, multilingual system and multiple theme support. Also its rich graphic library helps designers to create colorable themes instead of designing multiple themes.Description
Limny suffers from a XSS issue in '/admin/login.php' that uses the 'PHP_SELF' variable. The vulnerability is present because there isn't any filtering to the mentioned variable in the affected script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.--------------------------------------------------------------------------------
/admin/login.php
----------------
100: <form name="limny_login" action="<?php print $_SERVER['PHP_SELF']; ?>" method="post">
--------------------------------------------------------------------------------
Vendor
Hamidreza Samak - http://www.limny.orgAffected Version
3.0.1Tested On
Microsoft Windows XP Professional SP3 (EN)Apache 2.2.21
MySQL 5.5.16
PHP 5.3.8
Vendor Status
[04.01.2012] Vendor has some knowledge about the issue.[06.01.2012] Vendor releases version 3.0.2 to address this issue.
PoC
limny_xss.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] http://packetstormsecurity.org/files/108355/ZSL-2012-5066.txt[2] http://www.securityfocus.com/bid/51261
[3] http://cxsecurity.com/issue/WLB-2012010034
[4] http://secunia.com/advisories/47444/
[5] http://xforce.iss.net/xforce/xfdb/72113
[6] http://osvdb.org/show/osvdb/78093
[7] http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-5343
[8] http://www.securiteam.com/securitynews/6Y02Y0K60E.html
[9] http://www.securiteam.com/securitynews/6L02V0A60A.html
Changelog
[04.01.2012] - Initial release[05.01.2012] - Added reference [1], [2], [3] and [4]
[06.01.2012] - Added vendor status and reference [5] and [6]
[24.11.2012] - Added reference [7]
[29.11.2012] - Added reference [8] and [9]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
