KirbyCMS - exploit.company

vendor:

Kirby Panel

by:

Ishaq Mohammed

5,4

CVSS

MEDIUM

Stored Cross Site Scripting

CWE

Product Name: Kirby Panel

Affected Version From: 2.3.3

Affected Version To: 2.5.7

Patch Exists: YES

Related CWE: CVE-2017-16807

CPE: 2.3.3/2.4.2/2.5.7

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2017

KirbyCMS <2.5.7 Stored Cross Site Scripting

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

Mitigation:

The vulnerability is patched by the vendor in the version 2.5.7.

Source

Exploit-DB raw data:

# Exploit Title: KirbyCMS <2.5.7 Stored Cross Site Scripting
# Vendor Homepage: https://getkirby.com/
# Software Link: https://getkirby.com/try
# Discovered by: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# Platform: PHP
# CVE: CVE-2017-16807

1. Description
   
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16807

2. Proof of Concept

Steps to Reproduce:
Log in as an Editor and click on Site Options
Add the malicious .svg file which contains the javascript to the Site
Login to another browser with Admin Credentials.
Click on Site Options.
Click on the newly added .svg file

3. Reference

https://securityprince.blogspot.in/2017/11/cve-2017-16807-kirby-cms-257-cross-site.html   
https://getkirby.com/changelog/kirby-2-5-7

4. Solution

The vulnerability is patched by the vendor in the version 2.5.7.