ZeroCMS 1.0 Cross Site Scripting

                							

                ZeroCMS v1.0 Cross-Site Scripting Vulnerability

Vendor: Another Awesome Stuff
Product web page: http://www.aas9.in/zerocms
Affected version: 1.0
Severity: Medium
CVE: CVE-2014-4195 
Date: 20/06/2014

Discovered by: Filippos Mastrogiannis (@filipposmastro)

ZeroCMS is a very simple Content Management System Built using PHP and MySQL.

Description: ZeroCMS v1.0 is vulnerable to Cross-Site Scripting (XSS)

A cross site scripting vulnerability identified in the variable: "article_id" of 
the "zero_view_article.php" file which allows an attacker to execute arbitrary 
script code in the browser of an unsuspecting user in the context of the affected site.

This allows several different attack opportunities, mostly hijacking the
current session of the user or changing the look of the page by changing
the HTML on the fly to steal the user's credentials. This happens
because the user input is interpreted as HTML/JavaScript by the browser.

Proof Of Concept:

In order to trigger the vulnerability and to display an alert box with the session 
cookie use the following standard payload:

http://localhost/zerocms/zero_view_article.php?article_id=<script>alert(document.cookie);</script>






<p>