Arcadwy Arcade Script CMS

vendor:

Arcade Script CMS

by:

Anarchy Angel

8.8

CVSS

HIGH

Static XSS

CWE

Product Name: Arcade Script CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

An attacker can inject a malicious JavaScript code into the username field of the registration page, which will be executed when the username is displayed on the site. This can be done by filling in the rest of the fields and submitting the form. Usernames show in comments, game scores, and so on.

Mitigation:

Sanitize all input from the registers page form.

Source

Exploit-DB raw data:

#################################\
# Information          
# Script                 : Arcadwy Arcade Script CMS             
# Buy/Download   : http://arcadwy.com/                           
# Vulnerability      : Static XSS                                          
# Discovered by    : Anarchy Angel                                    
# Contact              : anarchy[dot]ang31 [@] gmail           
# Website              : http://hha.zapto.org                           
# Greets                : Xteaphn, lun0s, BSDgurl, progenic.  
\#################################/

[!] EXPLOIT
    1) Go to http://site.com/register.php
    2) In username field input XSS payload
    3) Fill in the rest of the fields and submit.
    4) Activate account!

Every time the accounts username is shown on the site the XSS will run.
Usernames show in comments, game scores, and so on.

[!] FIX: Sanitize all input from the registers page form.

# milw0rm.com [2009-03-27]