Geeklog 2.1.0 Cross Site Scripting
Posted on 10 December 2015
Security Advisory - Curesec Research Team 1. Introduction Affected Product: Geeklog 2.1.0 Fixed in: 2.1.1b3 Fixed Version Link: https://www.geeklog.net/filemgmt/visit.php/1156 Vendor Contact: geeklog-security@lists.geeklog.net Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/29/2015 Disclosed to public: 12/02/2015 Release mode: Coordinated release CVE: requested, but not assigned Credits Tim Coen of Curesec GmbH 2. Vulnerability Description CVSS Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Description There is at least one XSS vulnerability in the installation script of Geeklog. Geeklog recommends to delete the install directory and displays warnings in the admin area if this is not the case. However, deleting the install directory is not mandatory, so it should be assumed that not all users will delete it. 3. Proof of Concept http://localhost/geeklog-2.1.0/public_html/admin/install/bigdump.php?foffset=1&start=1&fn=te<script>alert(1)</script>st.sql $_REQUEST['site_url'], $_REQUEST['site_admin_url'], and $_SERVER['PHP_SELF'] may be vulnerable as well, but the attacker would need a valid sql backup file to trigger them. 4. Solution To mitigate this issue please upgrade at least to version 2.1.1b3: https://www.geeklog.net/filemgmt/visit.php/1156 Please note that a newer version might already be available. 5. Report Timeline 09/29/2015 Informed Vendor about Issue (no reply) 10/21/2015 Reminded Vendor of Disclosure Date 10/21/2015 Vendor asks for an additional two weeks for testing 11/17/2015 CVE Requested (no reply) 11/30/2015 Vendor releases fix 12/02/2015 Disclosed to public Blog Reference: https://blog.curesec.com/article/blog/Geeklog-210-XSS-121.html -- blog: https://blog.curesec.com tweet: https://twitter.com/curesec Curesec GmbH Curesec Research Team Romain-Rolland-Str 14-24 13089 Berlin, Germany
