Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Jul 2015 20:35:49 +0530
From: "Abhishek J.M" <>
Subject: CVE Request: October CMS - Stored XSS in image caption tag

Hello ,

October CMS <> , an open-source , self-hosted
Content Management System built based on the Laravel PHP Framework has been
found to be vulnerable to Stored Cross-site Scripting attack.

*Scenario :*

When any *normal* user logs into the October CMS , he is given an option to
update his account , where there is an option to upload his profile
picture. On uploading , the user is given an option to give a caption to
the uploaded image. This tab has been found vulnerable to stored XSS.

*POC  :*

Type in :  '  *<svg onload=alert(document.cookie)>*' inside the caption tab
of the image and save it. Logout of the user account and login as an
administrator. Now, simply visit the user profile (of the normal user) and
the JavaScript will be executed.

*Reporting date*           :    21st July , 2015

*Exploit Author *           :    Abhishek J M

*Vendor  Homepage   *:

*Product  Link             : *

*Version affected         :    *Possibly all the builds  i.e ,  < = Build
271  (Changelog

*Tested on                    :  *  Linux:- Ubuntu, Debian, PHP - 5.5

This issue has been  reported  to the vendor of this product  :

Is it possible to assign CVE identifier for this issue ?

Thank you


Abhishek J M
bi0s @ Amrita

Blog <>   |    XDA
<>    |

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.