Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities Dec 09 2014 09:51AM
simo morxploit com
Title: Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities
Author: Simo Ben youssef
Contact: Simo_at_Morxploit_com
Discovered: 02 November 2014
Updated: 9 December 2014
Published: 9 December 2014
MorXploit Research
Vendor: Concrete5
Vendor url: www.concrete5.org
Software: Concrete5 CMS
Versions: 5.7.2 and (probably older)
Status: Unpatched
Vulnerable scripts:
Original document: http://morxploit.com/morxploits/morxconxss.txt

About Concrete5 (from Wikipedia):
Concrete5 is an open source content management system (CMS) for publishing content on the World Wide Web and intranets.
Concrete5 was designed for ease of use, for users with a minimum of technical skills. It enables users to edit site content directly from the page. It provides version management for every page, similar to wiki software, another type of web site development software. concrete5 allows users to edit images through an embedded editor on the page.

To learn more please visit:

Concrete5 is vulnerable to Cross-Site Scripting, both bulkupdate.php and sitemap_drag_request.php scripts fail to properly sanitize user-supplied input.

PoC Exploit:
bulkupdate.php XSS is exploitable through $_REQUEST['gName']

Using HTTP GET Method:

Using HTTP POST Method:
POST http://target/index.php/dashboard/users/groups/bulkupdate/search


sitemap_drag_request.php XSS is triggered through $_REQUEST['instance_id'] but requires a valid ccm_token value which makes it unexploitable (unless the attacker somehow obtains a valid token)

Using HTTP GET Method:
igCID=147&destCID=148&instance_id="><BODY ONLOAD=alert(document.cookie)>&ctask=MOVE&ccm_token=1418116264:3ac1b1774

Validate/Sanitize user supplied-input through $_REQUEST['gName'] and $_REQUEST['instance_id']

Disclosure time-line
02 November 2014: Discovery.
03 November 2014: Initial report sent.
11 November 2014: Second contact.
No response.
09 December 2014: Public disclosure.

Author disclaimer:
The information contained in this entire document is for educational, demonstration and testing purposes only.
Author cannot be held responsible for any malicious use or damage. Use at your own risk.

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus