Geeklog 2.1.0 Cross Site Scripting

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: Geeklog 2.1.0  
Fixed in: 2.1.1b3  
Fixed Version Link: https://www.geeklog.net/filemgmt/visit.php/1156  
Vendor Contact: [email protected]  
Vulnerability Type: XSS  
Remote Exploitable: Yes  
Reported to vendor: 09/29/2015  
Disclosed to public: 12/02/2015  
Release mode: Coordinated release  
CVE: requested, but not assigned  
Credits Tim Coen of Curesec GmbH  
  
2. Vulnerability Description  
  
CVSS  
  
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N  
  
Description  
  
There is at least one XSS vulnerability in the installation script of Geeklog.  
  
Geeklog recommends to delete the install directory and displays warnings in the  
admin area if this is not the case. However, deleting the install directory is  
not mandatory, so it should be assumed that not all users will delete it.  
  
3. Proof of Concept  
  
  
http://localhost/geeklog-2.1.0/public_html/admin/install/bigdump.php?foffset=1&start=1&fn=te<script>alert(1)</script>st.sql  
  
$_REQUEST['site_url'], $_REQUEST['site_admin_url'], and $_SERVER['PHP_SELF']  
may be vulnerable as well, but the attacker would need a valid sql backup file  
to trigger them.  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 2.1.1b3:  
  
https://www.geeklog.net/filemgmt/visit.php/1156  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
09/29/2015 Informed Vendor about Issue (no reply)  
10/21/2015 Reminded Vendor of Disclosure Date  
10/21/2015 Vendor asks for an additional two weeks for testing  
11/17/2015 CVE Requested (no reply)  
11/30/2015 Vendor releases fix  
12/02/2015 Disclosed to public  
  
  
Blog Reference:  
https://blog.curesec.com/article/blog/Geeklog-210-XSS-121.html  
  
--  
blog: https://blog.curesec.com  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Romain-Rolland-Str 14-24  
13089 Berlin, Germany  
  
  
`