LFI and XSS vulnerability in openEngine

2010-11-1800:00:00

vulners.com

##############################################################################
openEngine Local File Inclusion and XSS Vulnerabilities

SecPod Technologies (www.secpod.com)
###############################################################################

SecPod ID: 1009 10/20/2010 Issue Discovered

Class: Local File Inclusion and XSS Severity: High

Overview:

openEngine is prone to local file inclusion and XSS vulnerabilities.

Technical Description:

openEngine is prone to a local file inclusion and XSS vulnerabilities. The
application fails to properly sanitize user-supplied input.

Input passed via the 'template' parameter in "cms/website.php" is not properly
verified before it is returned to the user. This can be exploited to obtain
potentially sensitive information and execute arbitrary HTML, script code
in an users browser session in the context of an affected site.

The exploit has been tested on openEngine 2.0 100226

Impact:

Successful exploitation allows an attacker to obtain potentially sensitive
information and execute arbitrary arbitrary HTML, script code in the context
of an affected site.

Affected Software:

openEngine 2.0 100226; other versions may also be affected.

References:

http://www.openengine.de
http://secpod.org/blog/?p=152
http://secpod.org/advisories/SECPOD_Openengine_LFI_XSS_Vuln.txt

Proof of Concepts:

Workaround:

Not available

Solution:

Not available

Risk Factor:

CVSS Score Report: 
    ACCESS_VECTOR          = NETWORK 
    ACCESS_COMPLEXITY      = MEDIUM 
    AUTHENTICATION         = NOT_REQUIRED 
    CONFIDENTIALITY_IMPACT = PARTIAL 
    INTEGRITY_IMPACT       = PARTIAL 
    AVAILABILITY_IMPACT    = PARTIAL 
    EXPLOITABILITY         = PROOF_OF_CONCEPT 
    REMEDIATION_LEVEL      = UNAVAILABLE 
    REPORT_CONFIDENCE      = CONFIRMED 
    CVSS Base Score        = 6.8 &#40;AV:N/AC:M/Au:NR/C:P/I:P/A:P&#41; 
    CVSS Temporal Score    = 6.1 
    Risk factor            = High

JSON