Cross-site Scripting Vulnerabilities in N-13 News
| Advisory ID: | HTB23005 |
| Product: | N-13 News |
| Vendor: | Network-13 |
| Vulnerable Versions: | 4.0.1 and probably prior |
| Tested Version: | 4.0.1 |
| Advisory Publication: | May 25, 2011 [without technical details] |
| Vendor Notification: | May 25, 2011 |
| Public Disclosure: | June 15, 2011 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] |
| Risk Level: | Medium |
|  |
| CVSSv2 Base Score: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
|
Advisory Details: |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in N-13 News, which can be exploited to perform cross-site scripting attacks.
1) Cross-site scripting vulnerabilities in N-13 News
1.1 Input passed via the GET "id" parameter to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/index.php?id=%3C/script%3E%3Cscript%3Ealert%28document.cookie% 29;%3C/script%3E
1.2 Input passed via the POST "parent" parameter to index.php (when POST "rating" parameter is set to "true") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
<form action="http://[host]/index.php" method="post">
<input type="hidden" name="rating" value="true">
<input type="hidden" name="parent" value="<script>alert(document.cookie);</script>">
<input value="OK" type="submit">
</form>
1.3 Input passed via the GET "id" parameter to admin.php (when GET "action" parameter is set to "editcomments" and GET "edit" parameter is set to "true") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/admin.php?action=editcomments&edit=true&id=%22%3E%3Cscript%3Ea lert%28document.cookie%29;%3C/script%3E
1.4 Input passed via the GET "pid" parameter to admin.php (when GET "action" parameter is set to "editcomments") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/admin.php?action=editcomments&pid=%22%3E%3Cscript%3Ealert%28do cument.cookie%29;%3C/script%3E
1.5 Input passed via the GET "id" parameter to admin.php (when GET "action" parameter is set to "options" and GET "mod" parameter is set to "newscats" and GET "edit" parameter is set to "true") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/admin.php?action=options&mod=newscats&edit=true&id=%22%3E%3Csc ript%3Ealert%28document.cookie%29;%3C/script%3E
1.6 Input passed via the GET "catid" parameter to admin.php (when GET "action" parameter is set to "options" and GET "mod" parameter is set to "imageuploads") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of affected website.
Exploitation example:
http://[host]/admin.php?action=options&mod=imageuploads&catid=%22%3E%3Cscrip t%3Ealert%28document.cookie%29;%3C/script%3E
|
- GDPR & PCI DSS Test
- Website CMS Security Test
- CSP & HTTP Headers Check
- WordPress & Drupal Scanning
Try For Free
Solution: |
| Upgrade to version 4.0.2. |
| |
References: |
[1] High-Tech Bridge Advisory HTB23005 - https://www.immuniweb.com/advisory/HTB23005 - Cross-site Scripting Vulnerabilities in N-13 News
[2] N-13 News - network-13.com - N-13 News is a complete and powerful news management system which gives you complete control over how your news is managed and displayed.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. |
|
Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
