Info

Last Modified

5 months ago

Percent Complete

100%

Disclosure

Feb 04, 2008

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Apr 28, 2008

Description

Gelato CMS contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the content variables upon submission to the comments.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Third Party Solution
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Technical

It is possible to store XSS in the user comments of a blog using Gelato CMS. No specific magic is required. Simply type your XSS directly into the comments box and click "Add Comment". Both non-signed in users and signed in administrators are affected because it is stored.

Solution

As of now, there is no vendor patch. It is recommended that comments be turned off for the moment. If comments are absolutely essential, then a quick work around would be to encode the comment before it goes into the database. In the file /[gelato-root]/admin/comments.php, add the following line " $_POST["content"] = htmlspecialchars($_POST["content"],ENT_QUOTES);". This should be added before the line: " if ($comment->addComment($_POST)) {header("Location:......." Around line 44 or thereabouts.