what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Elefant CMS 1.3.12-RC Cross Site Scripting

Elefant CMS 1.3.12-RC Cross Site Scripting
Posted Feb 17, 2017
Authored by Tim Coen | Site curesec.com

Elefant CMS version 1.3.12-RC suffers from multiple persistent cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
SHA-256 | cb68cea61a5731c1d2926a6f64a75543d5ed4edbf03a18f9eac70ef5da6d6f47

Elefant CMS 1.3.12-RC Cross Site Scripting

Change Mirror Download
Security Advisory - Curesec Research Team

1. Introduction

Affected Product: Elefant CMS 1.3.12-RC
Fixed in: 1.3.13
Fixed Version https://github.com/jbroadway/elefant/releases/tag/
Link: elefant_1_3_13_rc
Vendor Website: https://www.elefantcms.com/
Vulnerability XSS
Type:
Remote Yes
Exploitable:
Reported to 09/05/2016
vendor:
Disclosed to 02/02/2017
public:
Release mode: Coordinated Release
CVE: n/a (not requested)
Credits Tim Coen of Curesec GmbH

2. Overview

Elefant is a content managment system written in PHP. In version 1.3.12-RC, it
is vulnerable to multiple persistent as well as a reflected XSS issue. This
allows an attacker to steal cookies, inject JavaScript keyloggers, or bypass
CSRF protection.

3. Details

Persistent XSS: Username

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

The username is echoed in various locations in the administration backend
without encoding, leading to persistent XSS vulnerabilities. A user account is
required, but the registration is open by default.

Proof of Concept:

1. Register a new user (the registration is open by default). 2. Update the
profile, as name use: Username<img src=no onerror=alert(1)> To trigger the
payload: 1. Log in as admin 2. View the edit page for the user, for example:
http://localhost/user/edit?id=3 Alternatively, the payload is also echoed on
the page listing all users: http://localhost/admin/versions?id=&type=User As
well as on the version page: http://localhost/admin/versions?type=User&id=3

Persistent XSS: Version Comparison

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Various fields of various components are echoed unencoded when comparing
versions of those components. Examples are the user profile fields Name,
Address, Address 2, City, Title, Company, or About, or the Title, Menu Title,
Window Title, Description, or Keyword of a page.

Proof of Concept:

The comparison page can for example be seen here: http://localhost/admin/
compare?id=8&current=no

Persistent XSS: Page & Content Block

CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

The title of a new webpage is echoed unencoded, leading to persistent XSS. The
same issue also exists when creating blocks.

A user account with the right to create pages is required. By default, the
editor role has this right.

Proof of Concept:

Create a new page or block, as title use: </title><img src=no onerror=alert(1)>
The payload will be echoed in a title tag as well as a h1 tag when viewing the
page and when editing the page.

Persistent XSS: Blog Post

CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

The title as well as the tags of a blog post are echoed unencoded, leading to
persistent XSS.

A user account with the right to create pages is required. By default, the
editor role has this right

Proof of Concept:

Create a new blog post, as title and tag use: </title>'"><img src=no onerror=
alert(1)> The payload will be echoed in a title tag, a h1 tag, as well as a
href tag when viewing the page and when editing the page.

Reflected XSS

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

The name parameter of the custom fields component is vulnerable to reflected
XSS.

Proof of Concept:

GET /admin/extended?extends=User&name=%3Cimg%20src=no%20onerror=alert(1)%3E
HTTP/1.1

4. Solution

To mitigate this issue please upgrade at least to version 1.3.13.

Please note that a newer version might already be available.

5. Report Timeline

09/05/2016 Informed Vendor about Issue, Vendor announces fix
11/07/2016 Asked Vendor if recent releases fixes issues, Vendor confirmed
02/02/2017 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/Elefant-CMS-1312-RC-Multiple-Persistent-and-Reflected-XSS-191.html

--
blog: https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-StraAe 54
10365 Berlin, Germany


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close