PlumeCMS <= 1.2.4 - Multiple Persistent XSS

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PlumeCMS <= 1.2.4 Multiple Persistent XSS vulnerabilit

Reporter	Title	Published	Views	Family All 9
0day.today	PlumeCMS <= 1.2.4 Multiple Persistent XSS	4 Apr 201200:00	–	zdt
CVE	CVE-2012-2156	11 Apr 201210:00	–	cve
Cvelist	CVE-2012-2156	11 Apr 201210:00	–	cvelist
Exploit DB	Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities	4 Apr 201200:00	–	exploitdb
EUVD	EUVD-2012-2150	7 Oct 202500:30	–	euvd
exploitpack	Plume CMS 1.2.4 - Multiple Persistent Cross-Site Scripting Vulnerabilities	4 Apr 201200:00	–	exploitpack
NVD	CVE-2012-2156	11 Apr 201210:39	–	nvd
Packet Storm	PlumeCMS 1.2.4 Cross Site Scripting	5 Apr 201200:00	–	packetstorm
Prion	Cross site scripting	11 Apr 201210:39	–	prion


                                                +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title     : PlumeCMS &#60;= 1.2.4 Multiple Persistent XSS
# Date              : 04-04-2012
# Author            : Ivano Binetti (http://www.ivanobinetti.com)
# Software link     : http://sourceforge.net/projects/pxsystem/files/latest/download?source=directory
# Vendor site       : http://pxsystem.sourceforge.net/
# Version           : 1.2.4 (latest) and lower
# Tested on         : Debian Squeeze (6.0)
# Original Advisory : http://www.webapp-security.com/2012/04/plumecms/
# CVE               : CVE-2012-2156
+--------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Vulnerability Description
 2.1 &#34;u_email&#34; parameter
 2.2 &#34;u_realname&#34; parameter
 2.3 &#34;c_author&#34; parameter
3)Exploit
 3.2 Exploit &#34;u_email&#34; parameter
 3.2 Exploit &#34;u_realname&#34; parameter
 3.3 Exploit &#34;c_author&#34; parameter
+---------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
PlumeCMS is a &#34;Versatile Content Management System in PHP on top of MySQL&#34;.

2)Vulnerability Description
PlumeCMS 1.2.4 (and below) is prone to multiple peristent XSS vulnerability due to an improper input sanitization of multiple
parameters.
 2.1 &#34;u_email&#34; parameter
 &#34;u_email&#34;  parameters is not correctly sanitized before being passed to server side script &#34;manager/users.php&#34; via http POST 
 method. An attacker - who is able to change his profile settings - could insert malicious code into &#34;Email&#34; field
 - within &#34;Authors&#34; template - in order to create a persistent XSS vulnerability for all user/admin who access to Plume&#39;s 
 management interface.
 
 2.2 &#34;u_realname&#34; parameter
 &#34;u_realname&#34; parameter is not correctly sanitized before being passed to server side script &#34;manager/users.php&#34; via http POST 
 method. An attacker - who is able to change his profile settings - could insert malicious code into &#34;Name&#34; field
 - within &#34;Authors&#34; template - in order to create a persistent XSS vulnerability for all user/admin who access to Plume&#39;s 
 management interface.

 2.3 &#34;c_author&#34; parameter
 An unauthenticated user could insert html/javascript code in &#34;Author&#34; field within &#34;ADD A COMMENT&#34; section - which is present
 in every web page - due to an incorrect sanitization of &#34;c_author&#34; parameter. This will produce a Persistent XSS vulnerability
 for all user/admin who will click on &#34;Comments&#34; tab within Plume&#39;s administration interface. 

3)Exploit 
 3.1 Exploit &#34;u_email&#34; parameter
 Insert the following code in &#34;Email&#34; field within &#34;Authors&#34; template under &#34;manager/users.php?user_id=&#60;user_id&#62;&#34;:
 &#60;script&#62;alert(&#34;xss&#34;)&#60;/script&#62;

 3.2 Exploit &#34;u_realname&#34; parameter
 Insert the following code in &#34;Name&#34; field within &#34;Authors&#34; template under &#34;manager/users.php?user_id=&#60;user_id&#62;&#34;:
 &#60;script&#62;alert(&#34;xss&#34;)&#60;/script&#62;

 3.3 Exploit &#34;c_author&#34; parameter
 Insert the following code in &#34;Author&#34; field within &#34;ADD A COMMENT&#34; section&#34;:
 &#60;script&#62;alert(&#34;xss&#34;)&#60;/script&#62;
+----------------------------------------------------------------------------------------------------------------------------------+

01 Jul 2014 00:00Current

6.7Medium risk

Vulners AI Score6.7

EPSS0.01646