----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Full Featured Secunia Network Software Inspector (NSI) is now
available:
http://secunia.com/network_software_inspector/

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,000 different Windows applications.

----------------------------------------------------------------------

TITLE:
activeWeb contentserver Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA26063

VERIFY ADVISORY:
http://secunia.com/advisories/26063/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data, Exposure
of sensitive information

WHERE:
>From remote

SOFTWARE:
activeWeb contentserver 5.x
http://secunia.com/product/14785/

DESCRIPTION:
RedTeam Pentesting has reported some vulnerabilities in activeWeb
contentserver, which can be exploited by malicious users to disclose
potentially sensitive information, bypass certain security
restrictions, or conduct SQL injection and script insertion attacks,
and by malicious people to conduct cross-site scripting attacks.

1) A vulnerability in the way permissions are enforced in the
management interface allows an editor to create and edit restricted
documents.

2)  Input passed to the "msg" parameter in rights.asp and
transaction.asp is not properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.

3) Input passed to the name of a new mimetype is not properly
sanitised before being saved. This can be exploited to insert
arbitrary HTML and script code, which is executed in a user's browser
session in context of an affected site when the "mimetype" is viewed.

4) Input passed to the "id" parameter in
admin/picture/picture_real_edit.asp is not properly sanitised before
being used in SQL queries. This can be exploited to manipulate SQL
queries by injecting arbitrary SQL code.

5) A vulnerability exists in the page editor that enables malicious
users to bypass filtering and include HTML and script code in a
certain page by manipulating POST requests.

Successful exploitation of vulnerabilities #1, #3, #4, and #5
requires "editor" privileges.

The vulnerabilities are reported in versions before 5.6.2964.

SOLUTION:
Update activeWeb contentserver to 5.6.2964.

PROVIDED AND/OR DISCOVERED BY:
RedTeam Pentesting

ORIGINAL ADVISORY:
1) http://www.redteam-pentesting.de/advisories/rt-sa-2007-007.php
2, 3) http://www.redteam-pentesting.de/advisories/rt-sa-2007-005.php
4) http://www.redteam-pentesting.de/advisories/rt-sa-2007-004.php
5) http://www.redteam-pentesting.de/advisories/rt-sa-2007-006.php

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------