Symphony CMS 2.6.2 XSS Vulnerability

2015.06.09
Credit: John Page
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-79

[+] Credits: John Page ( hyp3rlinx ) [+] Domains: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt Vendor: ================================ www.getsymphony.com/download/ Product: ================================ Symphony CMS 2.6.2 Advisory Information: ================================================ Symphony CMS XSS Vulnerability Vulnerability Details: ===================== The 'sort' parameter used by author search in Admin is XSS exploitable. Symphony seems to escape injected strings e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript functions charCodeAt() & fromCharCode() e.g. String.fromCharCode(72,69,76,76) Now we can output our 'HELL' strings, construct URLs etc... Exploit XSS code(s): ==================== http://localhost/symphony-2.6.2/symphony/system/authors/?sort= </h1><script>alert(String.fromCharCode(72,69,76,76))</script><h1>&order=asc Disclosure Timeline: ========================================================= Vendor Notification: June 5, 2015 June 6, : Public Disclosure Severity Level: ========================================================= Med Description: ========================================================== Request Method(s): [+] GET Vulnerable Product: [+] Symphony CMS 2.6.2 Vulnerable Parameter(s): [+] sort Affected Area(s): [+] symphony/system/authors/ =============================================================== (hyp3rlinx)


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top