Security Advisory - Curesec Research Team 1. Introduction Affected Product: Elefant CMS 1.3.12-RC Fixed in: 1.3.13 Fixed Version https://github.com/jbroadway/elefant/releases/tag/ Link: elefant_1_3_13_rc Vendor Website: https://www.elefantcms.com/ Vulnerability CSRF Type: Remote Yes Exploitable: Reported to 09/05/2016 vendor: Disclosed to 02/02/2017 public: Release mode: Coordinated Release CVE: n/a (not requested) Credits Tim Coen of Curesec GmbH 2. Overview Elefant is a content managment system written in PHP. In version 1.3.12-RC, it is vulnerable to cross site request forgery. If a victim visits a website that contains specifically crafted code while logged into Elefant, an attacker can for example create a new admin account without the victims knowledge. 3. Details CVSS: Medium 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P There is no CSRF protection for various components, allowing among other the creation of new admin accounts or XSS attacks. Proof of Concept: Create New Admin:
XSS:
4. Solution To mitigate this issue please upgrade at least to version 1.3.13. Please note that a newer version might already be available. 5. Report Timeline 09/05/2016 Informed Vendor about Issue, Vendor announces fix 11/07/2016 Asked Vendor if recent releases fixes issues, Vendor confirmed 02/02/2017 Disclosed to public Blog Reference: https://www.curesec.com/blog/article/blog/Elefant-CMS-1312-RC-CSRF-189.html -- blog: https://www.curesec.com/blog tweet: https://twitter.com/curesec Curesec GmbH Curesec Research Team Josef-Orlopp-StraAe 54 10365 Berlin, Germany