Else If CMS Multiple File Inclusion and Cross Site Scripting Vulnerabilities


Description   Multiple vulnerabilities have been identified in Else If CMS, which could be exploited by remote attackers to execute arbitrary commands or scripting code.
The first issue is caused by input validation errors in various scripts (e.g. "elseif/utilisateurs/vousetesbannis.php" or "elseif/moduleajouter/depot/adminforum.php") when processing user-supplied parameters, which could be exploited by attackers to cause malicious scripting code to be executed by the user's browser.
The second flaw is caused by input validation errors in various scripts (e.g. "elseif/contenus.php" or "elseif/utilisateurs/votes.php") when processing user-supplied parameters, which could be exploited by malicious users to include malicious scripts and execute arbitrary commands with the privileges of the web server.
The third vulnerability is caused by missing authentication in the "elseif/externe/swfupload/upload.php", which could be exploited by remote attackers to upload malicious scripts and execute PHP commands with the privileges of the web server.
The fourth issue is caused by input validation errors in the "elseif/utilisateurs/votesresultats.php" script, which could be exploited by attackers to disclose the installation path.
     
Vulnerable Products   Vulnerable Software:
Else If CMS version 0.6 beta and prior
     
Solution  
     
CVE   CVE-2007-5306
CVE-2007-5305
CVE-2007-5304
     
References  
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious tag with event found in data
3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL
3.2.0
XSS - Prevention - POST : suspicious 'object' tag found in data
3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'applet' tag found in data
3.2.0
XSS - Prevention - POST : 'location' javascript object found in data
3.2.0
XSS - Phishing : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL
3.2.0
XSS - Prevention - POST : javascript code found in data
3.2.0
XSS - Prevention - POST : suspicious 'iframe' tag found in data
3.2.0
XSS - Prevention - POST : code allowing cookie access found in data
3.2.0
XSS - Phishing : suspicious 'a' tag found in URL
3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL
3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL
3.2.0
XSS - Phishing : suspicious 'form' tag found in URL
3.2.0
XSS - Prevention - POST : suspicious 'embed' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' tag found in data
3.2.0
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - POST : suspicious 'div' tag found in data
3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL
3.2.0
XSS - Phishing : suspicious 'link' tag found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
XSS - Prevention - POST : 'script' tag found in data
3.2.0
XSS - Prevention - POST : suspicious 'style' attribute found in data
3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL
3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL
3.2.0
     


 
 
 
 
 Risk level 
High 

 Vulnerability First Public Report Date 
2007-10-09 

 Target Type 
Client 

 Possible exploit 
Local & Remote