Two vulnerabilities have been discovered in BIGACE Web CMS, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks.

1) Input passed to the "id" parameter in public/index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

This vulnerability is confirmed in version 2.6. Other versions may also be affected.

2) Input passed via the "data[name]" parameter to public/index.php (when "cmd" is set to "admin" and "id" is set to "categoryCreate_tADMIN_len") when creating or updating a category is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.

Successful exploitation of this vulnerability requires permissions of the "Anonymous" user group.

This vulnerability is confirmed in version 2.7.1. Other versions may also be affected.

Solution
Update to version 2.7.2.

Provided and/or discovered by
1) Russ McRee, HolisticInfoSec
2) Bkis Security

Changelog
Further details available in Customer Area

Original Advisory
BIGACE:
http://bigace.cvs.sourceforge.net/viewvc/bigace/BIGACE/CORE/public/index.php?revision=1.22&view=markup
http://www.bigace.de/BIGACE-2.7.2.html

Bkis Security (Bkis-01-2010):
http://security.bkis.com/multiple-vulnerabilities-in-bigace-5/

Deep Links
Links available in Customer Area