Document Title: =============== Strato FAQ Center 2012 - Cross Site Scripting Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=372 Release Date: ============= 2012-01-06 Vulnerability Laboratory ID (VL-ID): ==================================== 372 Product & Service Introduction: =============================== FAQ / Login & Support Center of the Strato GmbH ... CMS by STRATO AG, Customer-Care IT - Ostendorff (Copy of the Vendor Homepage: http://www.strato.de & http://www.strato-faq.de ) Abstract Advisory Information: ============================== A Vulnerability-Lab researcher discovered a non persistent cross site scripting vulnerability in the strato vendor faq center cms 2012. Vulnerability Disclosure Timeline: ================================== 2012-01-03: Vendor Notification 2012-01-04: Vendor Response/Feedback 2012-01-05: Vendor Fix/Patch 2012-01-06: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A non persistent input validation vulnerability has been detected on the strato vendor faq center cms. The vulnerability allows remote attacker to hijack customer sessions with required user inter action click. Successful exploitation can result in client-side content manipulation, client side cross site scripting, session hijacking & client side phishing. Vulnerable File(s): [+] Kategories HTML Vulnerable Module(s): [+] Search Result - Input Fields & Output Listing Vulnerable Param(s): [+] sessionid & sub_kat Picture(s): ../1.png ../2.png ../3.png Proof of Concept (PoC): ======================= A non persistent input validation can be exploited by remote attackers with required user inter action(click). For demonstration or reproduce ... Domain: http://www.strato-faq.de/ Path: ../ File: kategorie.html Para: ?sessionID=54b42f322818fcab0086e80284dec399&page=4&sub_kat= ... ?sessionID= ... PoC: http://www.strato-faq.de/kategorie.html?sessionID=[Cross Site Scripting]div%20style=%221 http://www.strato-faq.de/kategorie.html?sessionID=%3E%22%3Ciframe%20src=http://vulnerability-lab.com%20width=900%20height=800%3E Code Review: OUTPUT Listing