General information

CMS Made Simple is a free content management system (CMS) written in PHP, available at www.cmsmadesimple.org. In March, 2010, Bkis Security discovered some XSS and CSRF vulnerabilities in CMS Made Simple 1.7.1. Taking advantage of these vulnerabilities, hacker is able to insert pieces of code into the path’s link to execute in user’s browser, causing the loss of cookies and session. Hacker is also able to trick users into manipulating some of the system’s functions without users’ knowledge. Bkis has informed the CMS Made Simple’s development team of these vulnerabilities.

Technical details

The XSS vulnerability is found in the following modules:

- Add Pages

- Add Global Content

- Edit Global Content

- Add Article

- Add Category

- Add Field Definition

- Add Shortcut

Since the input variants of this function are not carefully checked and filtered, hacker is able to insert pieces of code into the path’s link. When users sign in and click this link, the malicious code (JavaScript) will be executed, leading to the loss of cookies, session, etc.

The CSRF vulnerability is found in the following module:

- Changes group permission

Since a task is performed without seeking users’ prior permission first, users can be tricked into performing a task without awareness. Thus, hacker is able to perform malicious actions via legitimate users.

In addition, the vulnerabilities are all found in content management section of CMSMadeSimple. Thus, the victims of such vulnerabilities are the system’s administrators, editors and designers.

Solution

CMSMadeSimple’s development team has not issued the patches for these vulnerabilities yet. Thus, Bkis strongly recommends individuals and organizations that use this software to take caution when receiving links, and at the same time keep track of the information about the latest software version to update.

Bkis Security

Trackback URI | Comments RSS