Radiant CMS 1.1.3 Cross Site Scripting
Posted on 22 June 2016
# Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities # Exploit Author: David Silveiro # Exploit Author Github: github.com/davidsilveiro # Exploit Author Twitter: twitter.com/david_silveiro # Vendor Homepage: http://radiantcms.org/ # Software Link: http://radiantcms.org/download/ # Date: Zero day Radiant is a no-fluff, open source content management system designed for small teams. It is similar to Textpattern or MovableType, but is a general purpose content management system (not just a blogging engine) written in Ruby. Stored XSS 1 – File Title Upload The attacker must first be a user of sorts, as there's only 2 types of roles 'administrator' & 'designer' we're going with the assumption of the latter. Now as the designer we have the option to upload 'assets' such as files or images, here lyes one of the issues. When uploading, we're presented with the option to create a title for an image, which gets displayed back in the general repository where a user logged in as admin would also be able to see it. We're able to input our own javascript within this field, thus when a you then visit the 'assets' page, you will be presented with a pop up. Enter the example below. POC: Title: </script>alert('XSS')</script> Stored XSS 2 – User Personal Preferences This time round were faced with a lot more avenues to have our JS displayed back to us. Again, we're going with the assumption that we're logged in as a designer user. Let us navigate to the 'Settings page', where you'll see 2 options to edit Personal Preferences & Configuration, click on Edit Prefrences. POC: Name: <script>alert('XSS 1')</script> Email Address: <script>alert('XSS2')</script>@gmail.com Username: <script>alert('XSS3')</script> This will not only reflect back to you, as the designer, but also the back to the admin when he/she goes onto the http://127.0.0.1/admin/users/ and is presented with our users malicious 'NAME' parameter.
