Kentico CMS 7.0.75 – User Information Disclosure
# Exploit Title: Kentico CMS User Enumeration Bug # Google Dork: inurl:/CMSPages/logon.aspx <-- enumerates several Kentico CMS sites # Date: 02-25-2014 # Exploit Author: Charlie Campbell and Lyndon Mendoza # Vendor Homepage: http://www.kentico.com/ # Software Link: http://www.kentico.com/Download-Demo/Trial-Version # Version: [Version 7.0.75 and previous versions] This vulnerability is an unprotected page on the site where you can view all current users and usernames. To find out if a Kentico CMS is vulnerable go to http://site.com/CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx assuming that the Kentico CMS was installed to the root folder in the server. I have already notified the authors and security team for Kentico CMS, in their response they claimed they would issue a patch on 02-21-2014. |