SocialCMS 1.0.2 Cross Site Scripting

                							

                +------------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title     : SocialCMS <= 1.0.2 XSS (Persistent and Reflected) Vulnerabilities
# Date              : 30-03-2012
# Author            : Ivano Binetti (http://www.ivanobinetti.com)
# Vendor site       : http://socialcms.com
# Software link     : http://sourceforge.net/projects/socialcms/files/latest/download
# Version           : 1.0.2 (and lower)
# Tested on         : Debian Squeeze (6.0) 
# CVE               : CVE-2012-1982
# Original Advisory : http://www.webapp-security.com/2012/03/socialcms/
+------------------------------------------------------------------------------------------------------------------------------------+
Summary-
1)Introduction
2)Vulnerability Description
 2.1 Persistent XSS
 2.2 Reflected XSS
3)Exploit
+------------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
SocialCMS "is online software for developing dynamic websites.It allows non-technical users to create and make changes to a 
website easily. It can be used for setting up Company Website, Blog, Video site, Amazon shop, Membership Site, Adsense Site, 
Affiliate Review site, Twitter CMS or for Domain Monetization etc.".

2)Vulnerability Description
 2.1 Persistent XSS
 SocialCMS 1.0.2 (and lower) is prone to a persistent XSS vulnerability due to an improper input sanitization of 
 "TR_title" parameter, passed to "my_admin/admin1_list_pages.php" via http POST method. 
 Exploiting this vulnerability an authenticated user - which is able to publish an article - could insert arbitrary 
 code in web management interface "Title" field - under "my_admin/admin1_list_pages.php?id=<page_id>&action=edit" - that will be 
 executed when an administrator - or another user - will browse that web page.
  
 2.2 Reflected XSS
 The Improper input sanitization of "TR_title" parameter causes also a Reflected XSS for the user which inserts html/javascript 
 code. 


3)Exploit 
Insert the following code in "Title" field when you're creating a new page:
"><script>alert(document.cookie)</script>
+-----------------------------------------------------------------------------------------------------------------------------------+
<p>