Joomla! Component SIGE version

vendor:

Simple Image Gallery Extended

by:

Alwin Peppels

6.1

CVSS

MEDIUM

Cross-site Scripting

CWE

Product Name: Simple Image Gallery Extended

Affected Version From: 3.2.0

Affected Version To: 3.2.3

Patch Exists: YES

Related CWE: CVE-2017-16356

CPE: a:kubik-rubik:simple_image_gallery_extended

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

Joomla! Component SIGE version <= 3.2.3 Cross-site Scripting

Kubik-Rubik Simple Image Gallery Extended (SIGE) contains an XSS in the 'print.php' file. Insufficient sanitization of the 'caption' URL parameter allows injection of Javascript into the page. In versions <= 3.2.0 the 'name' and 'img' parameters are vulnerable as well.

Mitigation:

Update to version 3.3.0

Source

Exploit-DB raw data:

# Exploit Title: Joomla! Component SIGE version <= 3.2.3 Cross-site Scripting
# Date: 15-02-2018
# Software Link: https://downloads.kubik-rubik.de/joomla-extensions/plg_sige_v3.2.3.zip
# Exploit Author: Alwin Peppels
# Website: www.onvio.nl
# CVE: CVE-2017-16356
# Category: webapps

1. Description
Kubik-Rubik Simple Image Gallery Extended (SIGE) contains an XSS in the
'print.php' file.
Insufficient sanitization of the 'caption' URL parameter allows injection
of Javascript into the page.
In versions <= 3.2.0 the 'name' and 'img' parameters are vulnerable as well.
Google dork: inurl:plugin_sige/print.php

The version of the SIGE plugin can be determined with this file:
[JOOMLA]/plugins/content/sige/sige.xml

2. Proof of Concept


 [JOOMLA]/plugins/content/sige/plugin_sige/print.php?img=x&caption=<img%20src=x%20onerror=alert(%27XSS%27)>

3. Solution:

Update to version 3.3.0
https://downloads.kubik-rubik.de/joomla-extensions/plg_sige_v3.3.0.zip