Advisory ID: HTB23141
Product: GetSimple CMS
Vendor: get-simple.info
Vulnerable Version(s): 3.1.2 and probably prior
Tested Version: 3.1.2
Vendor Notification: January 23, 2013=20
Vendor Patch: April 26, 2013=20
Public Disclosure: May 1, 2013=20
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2013-1420
Risk Level: Low=20
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities =
in GetSimple CMS, which can be exploited to perform Cross-Site Scripting (X=
SS) attacks. The application has XSS filter, however it can be bypassed as =
demonstrated below.
1) Cross-Site Scripting (XSS) in GetSimple CMS: CVE-2013-1420
1.1 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data passed via the "id" HTTP GET parameter to "/admin/backup-edit.php"=
script. A remote attacker can trick a logged-in administrator to open a sp=
ecially crafted link and execute arbitrary HTML and script code in browser =
in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:=20
http://[host]/admin/backup-edit.php?p=3D1&id=3D"><scri<script></script>pt>a=
lert(document.cookie);</scri<script></script>pt>
1.2 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data passed via the "path" HTTP GET parameter to "/admin/upload.php" sc=
ript. A remote attacker can trick a logged-in administrator to open a speci=
ally crafted link and execute arbitrary HTML and script code in browser in =
context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:=20
http://[host]/admin/upload.php?path=3D"><scri<script></script>pt>alert(docu=
ment.cookie);</scri<script></script>pt>
1.3 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data passed via the "title" and "menu" HTTP GET parameters to "/admin/e=
dit.php" script. A remote attacker can trick a logged-in administrator to o=
pen a specially crafted link and execute arbitrary HTML and script code in =
browser in context of the vulnerable website.
The exploitation examples below use the "alert()" JavaScript function to di=
splay administrator's cookies:
http://[host]/admin/edit.php?title=3D"><scri<script></script>pt>alert(docum=
ent.cookie);</scri<script></script>pt>
http://[host]/admin/edit.php?menu=3D"><scri<script></script>pt>alert(docume=
nt.cookie);</scri<script></script>pt>
1.4 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data passed via the "path" and "returnid" HTTP GET parameters to "/admi=
n/filebrowser.php" script. A remote attacker can trick a logged-in administ=
rator to open a specially crafted link and execute arbitrary HTML and scrip=
t code in browser in context of the vulnerable website.
The exploitation examples below use the "alert()" JavaScript function to di=
splay administrator's cookies:
http://[host]/admin/filebrowser.php?path=3D"><scri<script></script>pt>alert=
(document.cookie);</scri<script></script>pt>
http://[host]/admin/filebrowser.php?returnid=3D"><scri<script></script>pt>a=
lert(document.cookie);</scri<script></script>pt>
---------------------------------------------------------------------------=
--------------------
Solution:
Upgrade to GetSimple CMS 3.2.1
More Information:
http://get-simple.info/start/changelog
http://get-simple.info/download
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23141 - https://www.htbridge.com/advisory/=
HTB23141 - Multiple Cross-Site Scripting (XSS) vulnerabilities in GetSimple=
CMS.
[2] GetSimple CMS - http://get-simple.info/ - GetSimple is an XML based, st=
and-a-alone, fully independant and lite Content Management System.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.