JAKCMS 2.0 PRO RC5 stored XSS via useragent HTTP header Injection

vendor:

JAKCMS PRO

by:

Saif El-Sherei

7.5

CVSS

HIGH

Stored XSS

CWE

Product Name: JAKCMS PRO

Affected Version From: JAKCMS PRO 2.0 RC5

Affected Version To: JAKCMS PRO 2.0 RC5 and probably earlier versions

Patch Exists: YES

Related CWE: N/A

CPE: 2.0:rc5:jakcms_pro

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox 3.0.15, IE 8

2011

JAKCMS 2.0 PRO RC5 stored XSS via useragent HTTP header Injection

An attacker can exploit this vulnerability since using an intercepting proxy, where an attacker can modify the 'user-agent HTTP header' the Header is displayed and stored unsanitized in the admin logs on failed and successful logins.

Mitigation:

Ensure that user-agent HTTP headers are sanitized before being stored in the admin logs.

Source

Exploit-DB raw data:

# Exploit Title: JAKCMS 2.0 PRO RC5 stored XSS via useragent HTTP header
Injection
# Date: 7-2-2011
# Author: Saif El-Sherei
# Software Link:
http://php.opensourcecms.com/scripts/redirect/download.php?id=480
# Version: JAKCMS PRO 2.0 RC5 and probably earlier version
# Tested on: Firefox 3.0.15, , IE 8
# Vendor Notified: vendor notified"7-2-2011", awaiting vendor response.
# Vendor Respons: http://www.jakcms.com/tracker/t/12/jakcms-2-pro-rc5-stored-xss-via-useragent-http-header-injection
# Google Dork: "Powered By JAKCMS"

Info:
Our content managament system PRO is made for professional websites any
kind. Content publishing, Forum, Blog, Events, Gallery, Tags, News,
Newsletter, Search, Security and more - the PRO has it all. CMS PRO is the
choice for people who are serious about creating thriving online websites.

Details:

An attacker can exploit this vuln since using an intercepting proxy, where
an attacker can modify the "user-agent HTTP header" the Header is displayed
and stroed unsantized in the admin logs on failed and successful logins.

POC:

useragent: <script>alert('XSS')</script>

Regards,

Saif El-Sherei
OSCP