Re: [Bkis] sNews 1.7.1 XSS vulnerability

[Henri Salo <henri () nerv fi>]

On Thu, May 12, 2011 at 09:59:16AM +0700, Bkis wrote:
> 1. General Information
>
> sNews is a free content management system (CMS) written in PHP and MySQL. It is available at http://snewscms.com/. In 
> April 2011, Bkis Security discovered an XSS (Cross-site Scripting) vulnerability in sNews CMS version 1.7.1. Taking 
> advantage of this vulnerability, hacker might execute malicious code or get cookie of CMS’s administrator.
>
> Details: http://security.bkis.com/snews-1-7-1-xss-vulnerability/
> SVRT Advisory:        Bkis 01-2011
> Initial vendor notification:  01/05/2011
> Release Date: 12/05/2011
> Update Date:  12/05/2011
> Discovered by:        Cao Xuan Sang - Bkis
> Attack Type:  XSS
> Security Rating:      High
> Impact:       Code Execution
> Affected Software:    sNews 1.7.1 ( possibly in some earlier versions )
>
> 2. Technical Descriptions
>
> XSS vulnerability exists in “reorder” functions of administrator: Categories reorder, Articles reorder and Pages 
> reorder. Here, input variables are not adequately checked and filtered before querying the database. Then if a 
> special character is added to the value, the SQL query will have wrong syntax, and the erroneous notification is 
> displayed in the browser accompanied with the value of the erroneous variable and the erroneous query, causing XSS 
> vulnerability.
> It is the administrators that are affected by this vulnerability. With different scenarios, hacker is able to steal 
> the Administrator’s cookie or redirect the browser to a malicious website, etc. 
>
> 3. Solution
> sNews’s development team has not issued the patches for this vulnerability yet. Thus, Bkis recommends individuals and 
> organizations use this software and fix the flaw as the below solution:
> Search in file snews.php:
>       $type_id = str_replace($remove,'',$key);
> Then, add the code below:
>       $value = clean(cleanXSS(trim($value)));
>
> 4. About Bkis
> Bkis is Vietnamese leading Company in researching, deploying network security software and solutions.
> website: http://bkis.vn

Identifier CVE-2011-2706 is assigned for this issue. Please edit advisory accordingly.

Best regards,
Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/