AOH :: HP Unsorted S :: BU-1580.HTM

Silverstripe <= v2.3.4: two XSS vulnerabilities



Silverstripe <= v2.3.4: two XSS vulnerabilities
Silverstripe <= v2.3.4: two XSS vulnerabilities



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Silverstripe CMS, , version 2.3.4 and lower 
(and its unreleased 2.4 branch), is vulnerable to two Cross Site
Scripting issues.

1. The comment posting mechanism of Silverstripe ('PostCommentForm')
fails to properly sanitize the 'CommenterURL' parameter. This allows for
persistent injection of HTML or javascript code within existing HTML tags.

2. The forum module is vulnerable to a reflective XSS issue caused by
the search script failing to properly sanitize input to the 'Search'
parameter. When invoking this URL:
SILVERSTRIPESITE/forums/search/?Search=%22%20onmouseover=%22javascript:alert%280%29;%22
trying to reorder the search results will trigger execution of the
injected javascript code.


According to its quickly responding developers, Silverstripe version
2.3.5 fixes both issues:
http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456 

Relevant SCM changesets:
http://open.silverstripe.org/changeset/97034 
http://open.silverstripe.org/changeset/97070 
http://open.silverstripe.org/changeset/97073 
http://open.silverstripe.org/changeset/97074 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEAREKAAYFAktZ9qEACgkQn6GkvSd/BgzVmACfaNiygTiaMy59QygEu0xeZ93S
KzsAoIIQA7krAVdNycjXdh7EaIMUiVk+
=9I4y
-----END PGP SIGNATURE-----

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.