[FD] DornCMS v1.4 - (FileManager) Persistent Cross Site Scripting Vulnerability

Document Title: =============== DornCMS v1.4 - (FileManager) Persistent Cross Site Scripting Vulnerability References (Source): ==================== http://ift.tt/2a6qBq8 Release Date: ============= 2016-07-26 Vulnerability Laboratory ID (VL-ID): ==================================== 1885 Common Vulnerability Scoring System: ==================================== 4.3 Product & Service Introduction: =============================== DornCMS is an extremely easy to use content management system written in PHP. It is meant for simple personal or informational websites that don't require a lot of interaction. This is a simple, easy to use, PHP Content Management System that is geared toward personal or informational websites with minimal interactivity. (Copy of the Homepage: http://ift.tt/2a8UlTt ) Abstract Advisory Information: ============================== A vulnerability laboratory core team researcher discovered an application-side input validation vulnerability in the official DornCMS v1.4 web-application. Vulnerability Disclosure Timeline: ================================== 2016-07-26: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== jdorndog Product: DornCMS - Content Management System (Web-Application) 1.4 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ A persistent cross site scripting vulnerability has been discovered in the official DornCMS v1.4 open source web-application. The vulnerability allows remote attackers to inject own malicious script codes to the client-side affected module or function. The vulnerability is located in the `name` parameter of the `filemanager` module. The name values inside the index listing are not secure parsed by the validation procedure. Thus allows remote attackers to inject via client-side GET method request of the filemanager own malicious script code context to the web-application. The request method to inject is GET and the attack vector is persistent after successful client-side execute. The security risk of the web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.3. Exploitation of the cross site web vulnerability requires no privileged web-application user account and only low user interaction. Successful exploitation of the vulnerability results in session hijacking, phishing attacks, external redirects to malicious sources and persistent manipulation of affected or connected application modules. Request Method(s): [+] GET Vulnerable Module(s): [+] Upload File Vulnerable Function(s): [+] Add Vulnerable Input(s): [+] Name Vulnerable Parameter(s): [+] name Affected Module(s): [+] File Manager Listing Proof of Concept (PoC): ======================= The client-side input validation vulnerability can be exploited by remote attackers without privileged user account and with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Inject: Upload File Execution: Filemanager (Delete & Rename) Manual steps to reproduce the vulnerability ... (local) 1. Open the web application and login as privileged user 2. Move to the filemanager by pushing the upload user button 3. Use the basic test file by default to rename 4. Include a script code payload as name to the new item via add GET request 5. The payload executes in the filemanager were the name value context is listed 6. Successful reproduce of the vulnerability! Manual steps to reproduce the vulnerability ... (remote) 1. Login with an administrator test account to the web-application 2. Now prepare with another computer with a browser 3. Prepare a website with a client-side GET method request to rename a file in the dorncms 4. Switch to the other PC with admin privileges and open the link with non-expired session 5. The code will be injected via GET to the filemanager index listing (default test file ever exists) 6. Successful reproduce of the vulnerability! PoC: Payload(s) http://ift.tt/2ad2Fzj ">.txt PoC: Filemanager - Source

Current Directory: files/< div id="fileinfo">

	Name	Preview	Size
	[SCRIPT CODE EXECUTION POINT VIA RENAME!]">.txt	This is an example file.	24 bytes	delete | rename

Source: Gmail -> IFTTT-> Blogger