[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 27 Jun 2015 00:46:47 +0530
From: Anirudh Anand <anirudhanand722@...il.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: Re: CVE Request: Anchor CMS - Multiple Stored and DOM Based XSS issues
Adding Further details regarding the issue: (sorry for not including the
details in the first mail).
1)
*Stored/Persistent XSS: *
While creating a new page (any authenticated user can create a new page),
the page title is not properly sanitized before saving the input the
database and hence users inject their own payloads. A sample POC can be
trying to give the following payload while adding a new page:
Page title = *page"onmouseover="alert(1)";*
Same injection can be also done on username field while creating a new user
or when editing an already existing user. So any user can purposefully add
JavaScript along with his name. If the user profile page is visited by the
admin or any other users, it will trigger the JavaScript.
2) *DOM Based XSS:*
DOM Based XSS occurs under every single URL below* /admin/*. A sample POC
can be:
http://localhost/anchor-cms/admin/posts/%3Cscript%3Ealert%281%29%3C/script%3E
<http://localhost/anchor-cms/admin/%3Cscript%3Ealert%281%29%3C/script%3E>
ttp://localhost/anchor-cms/admin/%3Cscript%3Ealert%281%29%3C/script%3E
<http://localhost/anchor-cms/admin/%3Cscript%3Ealert%281%29%3C/script%3E>
*Date of reporting:* 24th June, 2015
*Exploit Author:* Anirudh Anand
*Vendor Homepage*: https://anchorcms.com
*Software Link:* http://anchorcms.com/download
*Version: *< 0.9.2
*Tested on:* Linux:- Ubuntu, Debian
The issue has been reported to the vendor:
https://github.com/anchorcms/anchor-cms/issues/876
Is it possible to assign CVE identifiers for the same ?
Thank you,
On Thu, Jun 25, 2015 at 4:53 PM, Anirudh Anand <anirudhanand722@...il.com>
wrote:
> Hello,
>
> I would like to receive CVE identifier for the following Issues in the
> latest version of Anchor CMS:
>
> *Reference: *
> https://github.com/anchorcms/anchor-cms/issues/876
>
> Anchor CMS is a very popular content Management System. There are multiple
> Stored and DOM based XSS issues in it as reported in the reference. These
> issues persists in all the latest Anchor CMS releases.
> --
>
> Anirudh Anand
> bi0s@...ITA
> www.securethelock.com
>
> *"Those who Say it cannot be done, should not interrupt the people doing
> it"*
>
--
Anirudh Anand
bi0s@...ITA
www.securethelock.com
*"Those who Say it cannot be done, should not interrupt the people doing
it"*
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
