<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.51">
<TITLE>[x0n3-h4ck.org] Bug on Drake CMS v0.2</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>-=[--------------------ADVISORY-------------------]=-<BR>
<BR>
Drake CMS V. 0.2<BR>
<BR>
Author: CorryL x0n3-h4ck.org<BR>
-=[----------------------------------------------------]=-<BR>
<BR>
<BR>
-=[+] Application: Drake CMS<BR>
-=[+] Version: 0.2<BR>
-=[+] Vendor's URL: <A HREF="https://sourceforge.net/projects/drakecms/">https://sourceforge.net/projects/drakecms/</A><BR>
-=[+] Platform: Windows\Linux\Unix<BR>
-=[+] Bug type: XSS,Full Patch Diclouse<BR>
-=[+] Exploitation: Remote/Local<BR>
-=[-]<BR>
-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~<BR>
-=[+] Reference: www.x0n3-h4ck.org<BR>
-=[+] Virtual Office: <A HREF="http://www.kasamba.com/CorryL">http://www.kasamba.com/CorryL</A><BR>
<BR>
..::[ Descriprion ]::..<BR>
<BR>
Drake CMS is a dynamic web authoring and content managment system; it can be installed in a few minutes, almost all databases are supported plus an embedded flat file database. Its top features are security, speed, easy management and high customization.<BR>
<BR>
<BR>
..::[ Bug ]::..<BR>
<BR>
This CMS is affection from a bug type Cross-site script (RSS) and<BR>
a full patch diclouse, a remote attacker is able to exploit these<BR>
vulnerability to draw sensitive information.<BR>
<BR>
<BR>
..::[ Proof Of Concept ]::..<BR>
<BR>
1°) Cross-Site script (xss) Bug on<BR>
/index.php?option=contact&Itemid=10&task=category&id=<ScRiPt%20%0a%0d>alert(764606807)%3B</ScRiPt><BR>
<BR>
2°) Full path diclouse on<BR>
/classes/simplecaptcha/captcha.png.php<BR>
<BR>
<BR>
..::[ Workaround ]::..<BR>
<BR>
<A HREF="https://sourceforge.net/projects/drakecms/">https://sourceforge.net/projects/drakecms/</A><BR>
<BR>
..::[ Disclousure Timeline ]::..<BR>
<BR>
[01/11/2006] - Vendor notification<BR>
[01/11/2006] - Vendor Response<BR>
[04/11/2006] - Public disclousure<BR>
<BR>
<BR>
<BR>
*********************<BR>
Alice BASIC: mail, antivirus, antispam e invio allegati fino a 2 GB!<BR>
Per maggiori informazioni vai su: <A HREF="http://adsl.alice.it/servizi/alicebasic.html">http://adsl.alice.it/servizi/alicebasic.html</A> </FONT>
</P>
</BODY>
</HTML>