oss-security - CVE request - BigTree CMS 4.2.13 Extension Form Builder Multiple Cross-Site Scripting (XSS)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 24 Nov 2016 15:22:28 +0800
From: haojun hou <haojunhou@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request - BigTree CMS 4.2.13 Extension Form Builder Multiple
 Cross-Site Scripting (XSS)

Hi:
BigTree CMS 4.2.13 Extension Form Builder- Multiple Cross-Site Scripting (XSS) 

Procuct: BigTree CMS Extension Form Builder

Vendor: BigTree CMS Developer

https://www.bigtreecms.org/extensions/details/com.fastspot.form-builder

Vunlerable Version: 1.1

Tested Version: 1.1

Author: Haojun Hou in ADLab of Venustech 

Advisory Details:

Haojun Hou in ADLab of Venustech discovered Multiple Cross-Site Scripting (XSS) in BigTree CMS Extension “Form Builder”, which can be exploited to add,modify or delete information in application`s database and gain complete control over the application.

The vulnerability exists due to insufficientfiltration of user-supplied data in multiple HTTP POST parameters passed to “site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php” url. An attacker could execute arbitrary HTML and script code in browser in context of the vulnerable website.

The exploitation examples below uses the "alert()" JavaScript function to see a  pop-up messagebox:

(1)POST id= "?><script>alert("hacked by ADLab");</script><?"

(2)POST name= "?><script>alert("hacked by ADLab");</script><?"

(3)POST type= "?><script>alert("hacked by ADLab");</script><?"

Could you please help me assign a  CVE for this issue?

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.