Mura CMS Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA37194
VERIFY ADVISORY: http://secunia.com/advisories/37194/
DESCRIPTION: Vladimir Vorontsov has discovered some vulnerabilities in Mura CMS, which can be exploited by malicious people to disclose sensitive information, and conduct cross-site scripting and script insertion attacks.
1) Input passed to the “txtName” parameter in the comment section of blog entries e.g. go/default/blog/blog-post-with-flash-video/ is not properly sanitised before being used. This can be exploited to display e.g. SQL statements, database structure, installation path by entering values longer than 50 characters.
2) Input passed to the “txtName” and “txtUrl” parameters in the comment section of blog entries e.g. go/default/blog/blog-post-with-flash-video/ is not properly sanitised before being returned to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user’s browser session in context of an affected site when the malicious data is being viewed.
3) Input passed to the “link” parameter in default/includes/display_objects/sendtofriend/index.cfm is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
4) Input passed to the “returnURL” parameter in various pages including go/default/blog/index.cfm is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
The vulnerabilities are confirmed in version 5.1.937. Other versions may also be affected.
SOLUTION: Update to version 5.1.967.
PROVIDED AND/OR DISCOVERED BY: Vladimir Vorontsov
CHANGELOG: 2009-11-02: Updated “Solution” and “Original Advisory” sections.
ORIGINAL ADVISORY: http://www.getmura.com/index.cfm/blog/mura-cms-xss-vulnerability-fix/
http://onsec.ru/vuln?id=13 http://onsec.ru/vuln?id=14
———————————————————————-